Sigma detection rules, expert-reviewed

Windows: Suspicious Qemu execution with low-memory and network-tunneling flags

Alerts on Windows Qemu command lines using low -m values plus -netdev/connect= and -nographic.

Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)

Alerts when Windows Recall is enabled by setting the DisableAIDataAnalysis policy value to 0.

Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value

Flags deletion of WindowsAI\DisableAIDataAnalysis policy value indicating Windows Recall may be enabled.

Windows Recall Enabled via reg.exe Registry Changes (Windows)

Flags reg.exe commands that delete or set DisableAIDataAnalysis to 0 under WindowsAI to enable Windows Recall.

Windows Executable Connects to portmap.io Domain Over Network

Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.

Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)

Alerts when Acrobat/Office/PDF readers launch common browsers with HTTP(S) URLs, excluding known Microsoft and Foxit redirect patterns.

Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS

Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.

Windows Network Connections to Cloudflared Tunnel Domains

Alerts when a Windows process initiates outbound connections to Cloudflared tunnel domain hostnames.

Windows: File Creation by mysqld.exe With Script/Executable Extensions

Alerts on file creation by mysqld.exe producing .bat/.exe/.ps1/.vbs and other executable or script file types on Windows.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

Windows Registry: UAC PromptOnSecureDesktop Disabled

Detects setting UAC PromptOnSecureDesktop to 0 via Windows registry policy, disabling secure desktop for UAC prompts.

Windows Registry: UAC notification disabled via UACDisableNotify set to DWORD 0x00000001

Alerts on registry changes that disable UAC notifications by setting UACDisableNotify to 0x00000001 on Windows.

Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

Windows Process: File Recovery from Backup via wbadmin.exe

Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.