Sigma detection rules, expert-reviewed

Windows: Zone.Identifier Alternate Data Stream Deleted by Uncommon Application

Alert on deletion of the Zone.Identifier ADS by an uncommon process on Windows.

Suspicious Child Process Spawned by WinRAR.exe on Windows

Alerts when WinRAR.exe launches command, scripting, or proxy execution binaries on Windows.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting

Flags Excel-related process command lines that disable Python function execution warnings via PythonFunctionWarnings=0.

Windows Process Execution Triggered from WebDAV LNK Paths

Alerts on explorer.exe launching cmd/cscript/mshta/powershell/wscript/pwsh when the command line references a WebDAV \DavWWWRoot\ LNK path.

Windows Registry: New BgInfo UserFields value enabling custom WMI query execution

Alerts on new BgInfo UserFields registry entries that appear to configure a custom WMI query.

Windows Registry: New BgInfo UserFields value enabling custom VBScript execution

Detects registry changes under BgInfo UserFields that can be configured to run custom VBScript via BgInfo.exe.

Windows Registry Set: New BgInfo Database Path Value

Detects registry writes under BgInfo database configuration that set a new external database path.

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Windows Bash.exe Launched Without Script Execution Arguments

Alerts on bash.exe launched without script-execution flags, a potential stealthy way to run bash-driven payloads on Windows.

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Alerts when aspnet_compiler.exe runs with command lines indicating user-writable or temp/task paths.

Suspicious Child Process of aspnet_compiler.exe on Windows

Alerts when aspnet_compiler.exe spawns calc/notepad or executes from public/temp/Task-related paths on Windows.

Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs

Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.

Windows DLL sideloading via unsigned mfdetours.dll loaded by image_load

Alerts on loading unsigned \mfdetours.dll, consistent with DLL sideloading abuse via mftrace.exe.

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.