Sigma detection rules, expert-reviewed

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

Windows SMB Server Share Connection Without Signing or Encryption

Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.

Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming

Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.

Windows Process Execution: Restic Backup Tool Command-Line Indicators

Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.

WSL Process Execution of Kali Linux on Windows

Flags Kali Linux running under WSL on Windows using process creation image and command-line indicators.

Windows WSL Kali Linux installation via wsl.exe --install -i

Flags wsl.exe commands that install a distribution specified as Kali Linux using --install -i.

Windows Registry RunMRU Key Deletion

Alerts on deletion of the Windows Run dialog command history (RunMRU) registry key.

Windows: Detect reg.exe Deletion of RunMRU Registry Key

Alerts on reg.exe commands that delete the RunMRU registry key, clearing Run dialog command history.

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Flags Windows execution of trufflehog.exe, especially when targeting common code and collaboration platforms and using --results=verified.

Windows Process Execution of EDR-Freeze Tool

Flags execution of EDR-Freeze on Windows using image-name and IMPhash matches associated with the tool.

Windows Process Creation: WerFaultSecure.exe PPL Tampering with Dump/Impair Parameters

Alerts on WerFaultSecure.exe executions with PPL-related dump/impair command-line parameters that may target sensitive security protections.

Windows Process Creation: Command-Line Deletion of IIS Logs

Flags command-line attempts on Windows to delete IIS logs using common deletion utilities and the \inetpub\logs\ path.

Windows: Suspicious Velociraptor Child Process Execution Indicators

Alerts when Velociraptor.exe spawns specific child processes tied to tunneling, msiexec web installs, or PowerShell download commands.