Sigma detection rules, expert-reviewed

Windows: wordpad.exe Initiated Network Connections on Uncommon Ports

Alerts when wordpad.exe initiates outbound connections on destination ports outside common C2-related ports.

Windows Office Apps Initiating Network Connections to Non-Common Ports

Alerts on network connections initiated by Windows Office apps to destination ports not in the common port set.

Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders

Alerts on Windows file writes involving RECYCLERS.BIN\ or RECYCLER.BIN\ paths often used for staging.

Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations

Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.

Windows: Recon command output piped to findstr.exe

Alerts on Windows command lines running recon commands whose output is filtered with findstr.exe.

Windows process creation: WerFault.exe executed with -pr flag

Alerts when WerFault.exe is launched with the -pr argument, potentially indicating ReflectDebugger-based execution.

Windows PowerShell Decryption-Like Activity Involving .LNK File Processing

Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.

Windows Process Execution of curl.exe with --insecure Flag

Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.

Windows Registry: Uncommon Microsoft Office Trusted Location Path Added

Alerts on registry changes adding non-standard Microsoft Office Trusted Location paths that could undermine macro security.

Windows Registry TrustRecords Change for Macro-Enabled Documents in Suspicious Paths

Alert on Windows registry changes to Office TrustRecords where trusted-document paths fall in suspicious directories.

Windows: Office Executable Running a Document from Trusted Template/Startup Paths

Alerts when Office apps are launched with command lines pointing to documents under Office template/Startup paths.

Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality

Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.

Windows ShellDispatch.dll DLL Sideloading via Image Load Monitoring

Alerts on suspicious loads of ShellDispatch.dll on Windows when not occurring in expected temp directories.

Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

Windows Security 4719: Important Audit Policy Categories Disabled

Alerts on Windows Security 4719 indicating auditing was disabled for important security event subcategories.