Sigma detection rules, expert-reviewed

Windows DNS Queries Triggered by finger.exe

Alerts on Windows DNS queries made by finger.exe, a rarely used utility that can be abused to fetch remote commands.

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Flags PowerShell command lines that reference KerberosRequestorSecurityToken and .GetRequest() for suspicious Kerberos ticket requests.

Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands

Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.

Windows svchost.exe Uncommon Command-Line Parameter Process Creation

Alerts on Windows process starts of svchost.exe that include an uncommon -k parameter format, after excluding common and benign patterns.

Windows CMD for /f Tokens= with Recursive Dir Listing

Flags cmd.exe for /f loops using tokens= with recursive dir enumeration in the command line and parent.

Windows Registry: Suspicious Space-Padded TypedPaths Details String

Alerts on registry writes to TypedPaths url1 where Details includes “#” plus unusual Unicode space padding.

Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter

Alerts on RunMRU registry updates containing '#' plus excessive unusual Unicode spaces that may conceal command text.

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Alerts when Explorer spawns a process with command lines containing long Unicode whitespace padding followed by '#'.

Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.

Windows Registry Add WFP Filter Rules via BFE Parameters Path

Alerts on registry changes adding persistent WFP filters under the BFE policy persistent filter path via svchost.exe.

Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

Windows process creation: child process spawned by winrshost.exe

Flags Windows process children of winrshost.exe that may indicate WinRS-driven remote command execution.

Windows Winrs.exe Local Command Execution via localhost/loopback

Alerts on Winrs.exe processes running locally by targeting localhost/loopback in /r or /remote.

Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes

Alerts on .jsp writes into Apache/Tomcat webapps ROOT from dotnet/java/IIS worker processes on Windows.

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.