Sigma detection rules, expert-reviewed

Windows Named Pipe Creation: Alternate PowerShell Host via \PSHost

Alerts on creation of \PSHost named pipes to identify alternate PowerShell host usage via Windows pipe events.

Windows: WinRM inbound network connections to ports 5985/5986 for PowerShell remoting

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

Windows Suspicious Debugger Registration via Image File Execution Options

Alerts on Windows attempts to set Image File Execution Options debuggers for logon screen binaries via command-line arguments.

Windows Process Creation: Empire PowerShell UAC Bypass CommandLine Pattern

Flags Windows process creation events running Empire-style PowerShell UAC bypass command fragments.

Windows Registry: Modification of WDigest IsCredGuardEnabled to Disable Credential Guard

Alerts on Windows registry changes to WDigest\IsCredGuardEnabled that may disable Credential Guard.

PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

Alerts when csc.exe is launched from user/temp-like paths, indicating potential on-the-fly .NET compilation.

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

Windows: WmiPrvSE.exe Spawning a Child Process

Identifies child processes created by WmiPrvSE.exe on Windows, highlighting potential WMI-based execution attempts.

Windows Security: Non-System SeTakeOwnershipPrivilege granted on SCM database object

Flags non-system users requesting SeTakeOwnershipPrivilege on the SCM database object servicesactive in Windows Security 4674.

Windows Security: SysKey-related LSA Registry Key Access (4656/4663)

Alerts on access to LSA registry keys used to compute SysKey based on Windows Security handle and registry object events.

Windows Security Event 4656: Non-system handle failure to SCM database object

Alerts on failed SCM database handle requests for ServicesActive from non-system logons using Windows Security Event ID 4656.

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.