Sigma detection rules, expert-reviewed

Suspicious curl.exe File Downloads From Direct IP Addresses on Windows

Alerts on Windows curl.exe commands downloading from an IP address with HTTP/S and suspect file extensions.

Windows Process Execution: curl.exe with Custom User-Agent Header

Flags Windows executions of curl.exe that include a User-Agent header in the command line.

Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar

Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.

Windows Terminal settings.json modified by uncommon process

Alerts on Windows Terminal settings.json changes made by an uncommon command-line or script host process.

Windows Sysmon FileExecutableDetected (Event ID 29) Alerts on New Executable Files

Alerts on any Sysmon Event ID 29 indicating a new monitored executable file was created on Windows.

Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows

Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

Windows netsh.exe Advanced Firewall Rule Set Modification

Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Alerts when cmd.exe runs a one-liner that includes both ping and copy with expected options.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows DLL Sideloading: CCleanerReactivator.dll Loaded from CCleaner Directories

Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.

Windows DLL Sideloading via CCleanerDU.dll ImageLoad from CCleaner Folder

Alerts when CCleanerDU.dll is loaded, but the loading image is not CCleaner executables in standard install paths.

Windows Process Creation From Fake Recycle.Bin Directories

Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.