Sigma detection rules, expert-reviewed

Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

Windows Process: File Recovery from Backup via wbadmin.exe

Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.

Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files

Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.

Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)

Alerts on outbound connections started by Windows dialer.exe, excluding common local and reserved IP ranges.

Windows Process Creation: SoftPerfect netscan.exe Network Scanner Execution

Alerts on execution of SoftPerfect Network Scanner (netscan.exe), a potential network reconnaissance tool.

Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)

Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Alerts when a process uses NirCmd.exe PE metadata while the executable name is renamed to nircmd.exe or nircmdc.exe.

Windows TeamViewer Remote Session Process Command Line Start

Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.

Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files

Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.

Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)

Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.

Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process

Alerts on registry modifications to SentinelOne scan context menu command entries not matching SentinelOne’s expected binary.