Sigma detection rules, expert-reviewed

Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember

Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.

Windows SimpleService Execution via Remote Access Tool Wrapper Paths

Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.

Suspicious File Downloads via PowerShell.EXE from File Sharing Domains on Windows

Flags PowerShell downloading content from known file-sharing/paste domains using DownloadString/DownloadFile or web request syntax.

Windows Module Usage Enumeration via tasklist.exe -m rdpcorets.dll

Flags tasklist.exe module enumeration (-m) targeting rdpcorets.dll to identify the owning process.

Windows sc.exe Service Query for termservice Enumeration

Alerts on sc.exe service querying that references termservice on Windows.

Windows: AnyDesk Execution Using Revoked Certificate Versions

Detects AnyDesk.exe execution on Windows when the file version matches known revoked-certificate releases (excluding uninstall/remove).

Windows iexpress.exe Creates Self-Extracting Binaries Using SED Files From Suspicious Paths

Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.

Windows: Alerts on Creation of .sed Self-Extraction Directive File

Flags creation of newly created .sed directive files on Windows, which can be used for self-extracting package abuse.

Windows Self Extraction Directive (.sed) File Created in Suspicious Paths

Alerts on .sed directive file creation under ProgramData/Temp/Tasks paths on Windows, consistent with iExpress-based packaging abuse.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.

Windows SharpMove (.NET) Execution via SharpMove.exe and Action Command-Line Flags

Alerts on SharpMove.exe process execution with command-line actions for DCOM, WMI VBS, and task scheduler.

Windows EDRSilencer Execution via Filtering Platform FilterName Change

Detects Filtering Platform custom outbound filter additions associated with potential EDRSilencer execution on Windows.

Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments

Flags SOAPHound execution on Windows by detecting command-line arguments used for Active Directory data collection.

Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.

Windows Code Page Change via mode.com Selecting Russian Code Pages

Alerts when mode.com is used to set console code pages to Russian values (1251 or 866).