Sigma detection rules, expert-reviewed

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

Windows Process Creation: curl Uploads to File-Sharing Domains

Detects curl commands on Windows uploading files to common file sharing/upload domains.

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Alerts on Windows Python command-line one-liners that import base64 and call decode functions.

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Suspicious File Creation by OpenEDR ITSMService on Windows

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.

Windows Process Creation: node.exe Running npx skills add New Agent Skills

Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.

Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting

Flags registry changes that disable Windows Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0).

Windows Vulnerable Driver Blocklist Registry Tampering via PowerShell or REG.EXE

Flags PowerShell/REG.EXE command lines that change the VulnerableDriverBlocklistEnable registry setting under \Control\CI\Config.

Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

Windows Registry: Alert on Changes to \shell\open\command Targeting Common Malware Paths

Alerts on registry_set events modifying \shell\open\command to point to suspicious temp/user-writable locations.