Sigma detection rules, expert-reviewed

Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Flags Windows 4624 successful logons consistent with Pass-the-Hash activity using NtLmSsp or seclogo.

Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names

Alerts when Java Update Scheduler descriptions are used to execute a process ending with \jusched.exe on Windows.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

Windows: Suspicious Service Installation via Registry ImagePath Outside system32

Alerts on NalDrv/PROCEXP152 service ImagePath registry entries configured outside the expected system32 driver path.

Windows Suspicious PROCEXP152.sys Creation in Local Temp Folder

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

Windows Security Event 4673: SeLoadDriverPrivilege Use by Non-Whitelisted Processes

Flags Windows Event 4673 instances where SeLoadDriverPrivilege is exercised, suggesting attempts to load or unload kernel-mode drivers.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Security 5145 Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.

Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)

Alerts on GPO changes writing ScheduledTasks.xml to SYSVOL, indicating scheduled-task persistence at scale.