Sigma detection rules, expert-reviewed

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Alerts on enabling the Outlook LoadMacroProviderOnBoot registry setting, which can allow automatic VBA module loading at startup.

Windows: New Outlook VBAProject OTM Macro File Created

Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.

Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

Detects Exchange Management changes to OAB ExternalUrl containing script indicators and Page_Load.

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Alerts on schtasks.exe commands that create one-time scheduled tasks referencing a Temp directory.

Windows: Suspicious Service Binary Executed from Public/System Directories

Alerts on service-hosted processes executing from user/public or system-writable directories on Windows.

Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

Flags registry persistence where script payload indicators like vbscript: and RunHTMLApplication appear in set registry values.

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.

Windows rundll32 Executing Inline VBScript via RegRead

Detects rundll32.exe command lines containing inline VBScript execution with RegRead and window.close.

Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin

Flags PowerShell executions that Add-PSSnapin Exchange snap-ins, consistent with Exchange mailbox/config data collection.

Windows PowerShell TcpClient reverse-shell connection attempt via Net.Sockets

Alerts on PowerShell processes launching with .NET TcpClient stream/write patterns consistent with reverse TCP connectivity.

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

Windows Process Creation: finger.exe Execution

Alerts on Windows executions of finger.exe, a legacy utility that may indicate suspicious reconnaissance or network activity.

Windows ScreenConnect Installation Execution via Remote Access Parameters

Flags Windows executions of ScreenConnect with remote access command-line parameters indicating remote session setup.

Windows Process Creation: logman.exe Used to Stop or Delete ETW Trace Sessions

Alerts when logman.exe is used to stop or delete Windows ETW trace sessions.

Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Detects AdFind executions on Windows that include common AD reconnaissance parameters.