Sigma detection rules, expert-reviewed

Windows: Identify RpcPing.exe -s RPC test that requests NTLM authentication

Detects RpcPing.exe RPC test usage with parameters indicating NTLM authentication attempts.

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.

Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows

Flags WINWORD.exe runs that include /l and a .dll indicator, suggesting potential DLL sideloading on Windows.

Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

Detects Runscripthelper.exe executions with "surfacecheck" in the command line on Windows.

Windows Rasautou.exe DLL loading with -d and export execution via -p

Flags Rasautou.exe running with -d and -p to load a DLL and execute a specified export.

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

Windows Arbitrary File Download via GfxDownloadWrapper.exe URL Argument Execution

Flags GfxDownloadWrapper.exe executions that include http/https URLs for downloading files, excluding a known Intel gameplay API URL.

Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution

Flags Windows executions of ftp.exe using -s or /s, indicating potential scripted command abuse.

PowerShell Script Obfuscation Triggered by Use of clip.exe and Clipboard Invocation

Flags PowerShell Script Block Logging containing clip.exe/clipboard chaining and clipboard-driven execution markers.

PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content

Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows System: mshta Launches vbscript:createobject via Service Control Manager (Event ID 7045)

Flags Windows service creation (7045) where ImagePath includes mshta and vbscript:createobject.

Windows System: Suspicious Clip.exe Execution via Service Control Manager (Event ID 7045)

Alerts on Windows service creation starting clipboard/Clip.exe-related binaries via Service Control Manager ImagePath.

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.