Sigma detection rules, expert-reviewed

Windows WerFault ReflectDebugger Registry Key Value Targeting

Flags registry set events targeting WerFault ReflectDebugger under Windows Error Reporting Hangs for potential persistence abuse.

PowerShell Certificate Export Cmdlets in Windows Process Creation

Flags PowerShell command lines invoking certificate export cmdlets (Export-PfxCertificate/Export-Certificate) on Windows.

Windows WWlib.DLL sideloading via Office process loading behavior

Alert on Windows image-load events where winword-associated processes load wwlib.dll outside expected Office paths.

Windows CreateStreamHash: Suspicious Embedded File Download Indicators via .zip TLD

Flags Windows downloads indicating .zip/ plus ':Zone' in target filenames for risky executable or script extensions.

Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

Flags rundll32.exe launches with command-line ordinal obfuscation patterns.

Windows: Suspicious rundll32 Execution of advpack.dll with Ordinal RegisterOCX Calls

Identifies rundll32.exe launching advpack.dll with ordinal-style calls consistent with stealthy OCX registration behavior.

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Alerts on Windows processes running cloudflared tunnels with config and token/credential flags.

Windows: Detect cloudflared tunnel cleanup command execution

Flags Windows executions of cloudflared with tunnel cleanup and connector/config parameters.

Windows Registry: Internet Explorer DisableFirstRunCustomize Set via Explorer or ie4uinit

Alerts on Windows registry writes to Internet Explorer DisableFirstRunCustomize that change first-run wizard customization states.

Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag

Flags LiveKD executions with the "-m" option that may trigger kernel memory dumping on Windows.

Windows LiveKD Driver File Creation by Uncommon Process Image

Alerts when LiveKdD.SYS is created by a process other than livekd.exe/livek64.exe on Windows.

Windows LiveKD Driver Creation via LiveKdD.SYS and LiveKD Executable Launch

Detects creation of LiveKdD.SYS in the Windows drivers directory by LiveKD executables.

Windows: LiveKD kernel memory dump file creation (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Flags wscript.exe/cscript.exe launching files named with uncommon non-script extensions via command-line content.

Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)

Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.