Sigma detection rules, expert-reviewed

Windows Registry: Disable Windows Defender Exploit Guard Network Protection via Policy Override

Alerts on registry policy changes that override Exploit Guard Network Protection settings for Windows Defender.

Windows process access matching Cobalt Strike BOF injection call trace

Flags suspicious Windows process access consistent with CobaltStrike BOF injection using ntdll/KERNELBASE call traces and high GrantedAccess.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse

Identifies Windows processes with command-line arguments consistent with ADCSPwn targeting ADCS and a specified port.

Windows Process Creation: Recon Data Export via Command Prompt Redirection

Alerts when recon-related Windows utilities are launched with command-line output redirected to temp locations.

Windows: Suspicious Cabinet (CAB) File Expansion via expand.exe from Uncommon Paths

Flags expand.exe ("-F:") extracting cabinets when used from suspicious/uncommon Windows paths.

Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging

Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.

PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)

Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.

Windows Named Pipe Creation: Cobalt Strike Malleable Profile PipeName Patterns

Alerts on Sysmon named pipe creation with PipeName patterns commonly used by Cobalt Strike malleable C2.

Windows Named Pipe Creation Matching Cobalt Strike Malleable C2 Profile Patterns

Alerts on Windows named pipe creation with PipeName patterns consistent with Cobalt Strike Malleable C2 behavior.

Windows WinDivert Driver Load via Image or Known IMPHASHes

Detects WinDivert-related Windows driver loads using loaded image paths or known IMPHASH values.

PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows

Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.

Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.

PowerShell Script Block Collection of Documents via Recursive Get-ChildItem

Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.