Sigma detection rules, expert-reviewed

Malicious Service Permissions Hijacked for Privileges Abuse - Service (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

This rule detects a program launching from a mounted ISO, IMG or VHD volume, the delivery pattern adversaries use to bypass Mark-of-the-Web so downloaded payloads run without SmartScreen or Office protections. Container-file delivery is a recurring initial-access and defense-evasion behavior in the Red Canary Threat Detection Report, favored by loaders arriving through phishing. Detecting execution from a freshly mounted image surfaces the smuggled payload before it detonates.

Malicious Service Abuse with Backdoored "command Failure" - Service (via process_creation)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

CMSTP Execution of an INF Profile (via process_creation)

This rule detects cmstp.exe processing an INF connection profile, including remote profiles, a signed-binary proxy technique used to run commands and bypass application allowlisting and UAC. CMSTP abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-installer abuse for code execution.

Malicious Account Set with Reversible Encryption - Weakness Introduction (via security)

This rule detects set an account with reversible encryption to facilitate brutforce or cracking operations.

Suspicious Disabled Guest or Builtin Account Activated (via security)

This rule detects enables a disabled builtin account.

PsExec Remote Service Execution on Target Host (via process_creation)

This rule detects the PSEXESVC service binary executing on a host, which indicates a remote PsExec-style command was pushed to this machine over SMB for lateral movement. PsExec remote execution is a lateral-movement technique frequently seen in the Red Canary Threat Detection Report. Detecting the service-side artifact surfaces remote command execution landing on the target.

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via Command (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

XSL Script Processing via WMIC or MSXSL (via process_creation)

This rule detects XSL script processing through wmic.exe /format with a remote or local .xsl stylesheet or through msxsl.exe, both of which execute embedded script and proxy code past application allowlisting. XSL script processing is a signed-binary-proxy-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary abuse used to run attacker-controlled script.

Obfuscated File Decoding via Certutil (via process_creation)

This rule detects certutil being used with its decode flags to convert a base64 or hex-encoded file back into an executable payload, a deobfuscation step adversaries use to reconstruct malware from a benign-looking encoded file. Certutil deobfuscation is a defense-evasion technique in the Red Canary Threat Detection Report because it hides payloads from content inspection in transit. Detecting decode invocations surfaces payload staging under a trusted binary.

Malicious Network Share Manipulation via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Uncommon File Download via Uncommon LOLBIN (via process_creation)

This rule detects file-download abuse of lesser-known living-off-the-land binaries such as certreq -Post, desktopimgdownldr lockscreenurl and finger, which retrieve remote content while blending into signed Windows tooling. Ingress tool transfer via LOLBINs is a technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces payload retrieval that evades naive download monitoring.

Malicious Microsoft Defender Critical Security Components Disabled - Command (via process_creation)

This rule detects disable Defender security features.

Malicious User Password Change Without Previous Password Known - SetNTLM - Mimikatz (via security)

This rule detects perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

This rule detects wmic.exe invoking process call create, frequently against a remote node, which spawns a process through WMI for lateral movement or remote execution. WMIC-based remote execution is a technique tracked in the Red Canary Threat Detection Report for its use in hands-on-keyboard intrusions. Detecting this invocation surfaces attacker movement that blends into legitimate management traffic.