Every published rule

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.

Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe

Flags Gpg4win (gpg.exe/gpg2.exe) executions using passphrase-based encryption on Windows.

Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)

Identifies Windows Gpg4win (gpg.exe/gpg2.exe) decryption commands that include a passphrase keyword.

Windows Provisioning Registry Key Abuse Leading to Indirect Execution via Provlaunch.exe

Flags Windows command lines referencing the provisioning commands registry path commonly abused for Provlaunch.exe-based indirect execution.

Windows: Alert on Suspicious Child Processes Spawned by provlaunch.exe

Detects provlaunch.exe launching suspicious child executables and processes from common temp/task paths on Windows.

Windows Named Pipe Creation: Default RemCom Pipe Name

Alerts on creation of named pipes with names containing "\RemCom" on Windows.

Windows Named Pipe Created for CSExec Default Pipe Name

Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.

Windows RemComSvc Service Installation and Execution

Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).

Windows Service Control Manager Detects CSExecSvc Installation and Execution

Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).

Windows Portable Gpg.exe Execution from Uncommon Paths

Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.

Windows RemCom Service File Creation via RemComSvc.exe Filename

Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.

Windows CSExec Service File Creation (csexecsvc.exe)

Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.

Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries

Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.

Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading

Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.

Windows DLL Sideloading via mfdetours.dll using mftrace.exe

Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.

Windows ImageLoad DLL Sideloading: EACore.dll

Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.

Windows DLL sideloading via AVKkid.dll image loads

Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.

Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution

Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.

Windows Amazon SSM Agent Process Creation with Registration and Code Parameters

Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.

Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path

Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.