Sigma detection rules, expert-reviewed

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.

Windows UAC bypass using wsreset.exe with high/SYSTEM integrity

Alerts when wsreset.exe is executed with elevated integrity (High or SYSTEM), indicating a potential UAC bypass attempt.

Windows Process UAC Bypass via Windows Media Player osksupport.dll (osk.exe → cmd.exe)

Alerts on osk.exe spawning cmd.exe under mmc event viewer with high/system integrity, consistent with a UAC bypass attempt.

Windows UAC Bypass via pkgmgr.exe Launching dism.exe (High/System Integrity)

Detects pkgmgr.exe spawning dism.exe with High/System integrity levels on Windows, a pattern used in UAC bypass attempts.

Windows UAC Bypass via consent.exe and werfault.exe with comctl32.dll-related behavior

Alerts on consent.exe parent launching werfault.exe with high/system integrity levels, consistent with potential UAC bypass attempts.

Windows UAC bypass via changepk.exe launched from slui.exe with elevated integrity

Flags changepk.exe execution from slui.exe with High/System integrity to identify potential UAC bypass behavior on Windows.

Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters

Flags Windows executions of splwow64.exe where the command line ends at the executable with no parameters.

Windows UAC Bypass via WoW64 Logger DLL Hijack (Process Access Pattern)

Flags SysWOW64 process-access behavior with high granted access and unknown call traces consistent with a WoW64 logger DLL hijack UAC bypass.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

Windows Named Pipe Creation Matching EfsPotato-Style \\pipe\\srvsvc

Alerts on Windows named pipe creation events matching an EfsPotato-style PipeName pattern (\pipe\ and \pipe\srvsvc), excluding common benign contexts.

UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp

Flags file events where Temp\OskSupport.dll is targeted alongside DllHost.exe and Windows Media Player\osk.exe, consistent with a UAC bypass attempt.

Windows UAC Bypass via consent.exe with comctl32.dll file path pattern

Detects suspicious target path patterns involving consent.exe.@ and comctl32.dll consistent with UAC bypass staging.

Windows Office Applications Creating Executable/Script Files with Suspicious Extensions

Flags Office application processes creating .exe/.dll/.ps1 and other script or executable files on Windows.

Exchange Management: Certificate CSR exported to webserver or .aspx-named path

Flags Exchange CSR export commands that write request files to C$ and web-root paths or use an .aspx filename.