Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious calc.exe Command-Line Usage Outside System Locations

Alerts on suspicious calc.exe launches via command-line parameters or execution from non-standard Windows directories.

Windows bcdedit.exe Tampering for MBR/Boot Persistence (Delete, Import, SafeBoot, Network)

Alerts on bcdedit.exe executions with command-line options consistent with boot configuration tampering.

Windows Process Creation: Suspicious GUP.exe Execution from Non-Notepad++ Directories

Alerts on GUP.exe executions from unexpected directories on Windows, excluding known Notepad++ updater paths.

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Alerts on SysWOW64 remote thread creation initiated by script host or Office binaries consistent with CACTUSTORCH behavior.

Windows netsh.exe Used to Create RDP (3389) Port Forwarding

Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.

Windows netsh.EXE Adds Portproxy v4-to-v4 Forwarding Rule

Flags netsh.exe command lines that add portproxy v4-to-v4 forwarding rules on Windows.

Windows Firewall Rule Added via netsh.exe

Flags netsh.exe executions that add Windows firewall rules, indicating potential attacker-controlled network access changes.

Windows RDP Logon Using Localhost IP Address

Alerts on successful Windows logons (EventID 4624, LogonType 10) originating from localhost IPs.

Windows Registry: New Security Support Provider (SSP) added to LSA configuration

Alerts when a new SSP is added to LSA Security Packages in the Windows registry, excluding msiexec-driven changes.

Windows Script Execution from User-Accessible Paths via WScript, CScript, or MSHTA

Alerts when WScript/CScript/MSHTA launches scripts or HTAs referenced from user and temp directories.

Windows Process Creation Attempt Using wmic.exe process call create

Alerts on Windows process creation attempts invoking wmic.exe with “process call create”, a common pattern for WMI-based execution.

Windows Suspicious Child Processes Spawned by Web Server Executables

Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.

Windows Process Execution From Uncommon or Sensitive Directories

Alerts on process executions from uncommon/sensitive Windows directories, excluding specific IBM and Citrix updater paths.

Windows Shim Database Persistence via sdbinst.exe with .sdb Payload

Alerts when sdbinst.exe runs and references a .sdb shim database, indicating potential shim-based persistence.