Sigma detection rules, expert-reviewed

Windows DNS Client detects queries to Put.io subdomains (api.put.io, upload.put.io)

Alert on Windows DNS Client queries containing api.put.io or upload.put.io.

Windows Process Creation: BCP.EXE Used to Export SQL Data

Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.

Windows Process Masquerading as svchost.exe via Binary Name and Location

Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.

Windows File Access to Cryptocurrency Wallet Keystores by Uncommon Processes

Alerts on access to Ethereum/Bitcoin-style wallet files from non-standard processes on Windows.

Windows Process Creation Ending in .exe With No Image Name

Flags Windows process creation events where the .exe path exists but the image name is missing, indicating possible stealth or evasion.

Windows: Detect execution of renamed BOINC.exe binary

Flags renamed BOINC executables on Windows by matching OriginalFileName=BOINC.exe when the executed image name differs.

PowerShell Launch With --headless From Conhost.exe on Windows

Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.

Windows: Uncommon Process Access to Microsoft Teams Cookies or Local Storage leveldb

Alerts on access to Teams Cookies or leveldb files by processes other than Teams.exe on Windows.

Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification

Detects registry changes to COM CLSID Default InprocServer32/LocalServer32 values that point to suspicious locations.

Windows Process Creation: Renamed Microsoft Teams Executable Launch

Alerts when Microsoft Teams binaries are launched under renamed executable names on Windows.

Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)

Alerts when DsrmAdminLogonBehavior registry value is changed on Windows, except the default DWORD 0x00000000.

Windows Process Execution of BitLockerToGo.EXE

Alerts on Windows execution of BitLockerToGo.exe, a rarely used BitLocker To Go component for portable drive encryption.

Windows DLL Sideloading Suspected for ms<wbr>corsvc.dll via ImageLoad

Alerts on non-standard loads of msocrsvc.dll, a potential DLL sideloading opportunity on Windows.

Windows DLL Sideloading via MpSvc.dll Image Load Anomaly

Flags Windows module loads of MpSvc.dll outside typical Defender/WinSxS locations that may indicate DLL sideloading.

Potential DLL Sideloading: Image Load of DbgModel.dll on Windows

Alerts when a process loads DbgModel.dll from a non-standard path, suggesting possible DLL sideloading.