Sigma detection rules, expert-reviewed

Windows Process Creation: SoftPerfect netscan.exe Network Scanner Execution

Alerts on execution of SoftPerfect Network Scanner (netscan.exe), a potential network reconnaissance tool.

Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)

Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.

Windows TeamViewer Remote Session Process Command Line Start

Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.

Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files

Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.

Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)

Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.

Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process

Alerts on registry modifications to SentinelOne scan context menu command entries not matching SentinelOne’s expected binary.

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe

Alert on ScreenConnect.Service.exe spawning cmd.exe or csc.exe, consistent with potential web shell execution on Windows.

Windows DNS Queries to update.onelaunch.com by OneLaunch.exe

Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.

Windows Suspicious Wget.exe Downloads From IP to Common Staging Paths

Flags wget.exe on Windows downloading from an IP over HTTP and saving to common staging/user directories.

Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember

Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.