Sigma detection rules, expert-reviewed

Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.

Windows DNS Queries for IP Lookup Service Domains from Non-Browser Processes

Flags suspicious DNS lookups to IP-check API domains on Windows when they come from non-browser executables.

Windows Process Creation: MpCmdRun.exe Removing All Windows Defender Definitions

Flags MpCmdRun.exe launched to remove all Windows Defender definition files.

Windows Registry Defender Exclusions Path Set (Microsoft\Windows Defender\Exclusions)

Identifies registry updates that reference the Windows Defender Exclusions path, indicating potential defense impairment.

Windows Defender Exclusions Added via Windefend (Event ID 5007)

Alerts on Windows Defender exclusion additions based on windefend Event ID 5007 configuration change events.

Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings

Flags Defender tamper protection blocks to disable key Microsoft Defender Antivirus and real-time protection settings.

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

Windows reg.exe Run Key Modification for Persistence via Process Creation

Alerts on reg.exe commands that add values to Windows Run registry keys, a common persistence technique.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Windows PortProxy Registry Key Modified for Port Forwarding

Alerts when PortProxy port-forwarding registry entries under the Windows TCP v4tov4 path are added or modified.

Windows: Detect execution of renamed megasync.exe (original MegaSync) via process creation

Flags process launches where megasync.exe appears under a renamed or nonstandard execution context based on process creation fields.

Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters

Flags LDAP search queries indicative of Active Directory reconnaissance/enumeration using Event ID 30 filter patterns.

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

Windows Registry: New TaskCache entry created by unusual process image

Alerts when TaskCache registry entries are created by processes other than a defined set of expected Windows binaries.