Sigma detection rules, expert-reviewed

Windows Image Load of PCRE.NET Package Temp Module Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

Windows Processes Creating PCRE.NET Temp Package Files

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.

Windows Registry Persistence via Office Test Startup Key

Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.

Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32

Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.

Windows Registry: Detect esentutl.exe activity under VSS service keys

Flags registry changes under VSS service keys when initiated by esentutl.exe, consistent with VSS-related abuse.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

Windows DLL image load: credui.dll loaded by an uncommon process

Detects credui.dll or wincredui.dll being loaded by a process other than common system binaries.

Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)

Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.

Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)

Alerts on VSSAudit security event source registration in Windows Security logs using Event IDs 4904/4905.

Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r

Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.

Windows Process Execution and DLL Injection via Tracker.exe

Alerts on Tracker.exe executions with /d and /c command-line switches, excluding matching MSBuild child process patterns.

Windows: msdeploy.exe Execution with sync and RunCommand Parameters

Flags msdeploy.exe executions that include sync verb plus RunCommand source and destination parameters.

Windows PowerShell Process Creation: COMPRESS OBFUSCATION with ASCII Encoding and DeflateStream

Flags PowerShell process creation command lines that use ASCII encoding plus compression/stream-reading patterns associated with obfuscation.

Windows: Dotnet.exe executes arbitrary DLL or csproj files

Alerts when dotnet.exe runs with .csproj or .dll arguments that may indicate loading or execution of untrusted .NET code.