Sigma detection rules, expert-reviewed

Windows sc.exe Service Security Descriptor Tampering (sdset)

Detects sc.exe executions using sdset to modify service security descriptors, enabling stealthy service tampering.

Windows sc.exe Service Security Descriptor Changes via sdset

Alerts on sc.exe sdset activity that modifies a service security descriptor to grant access to targeted principals.

Windows Firewall Exception Rule Added for Application in Suspicious Path

Flags new Windows Defender Firewall exception rules for apps located in Temp/PerfLogs/Public/Tasks-like directories.

Windows: Mounting Internet Hosted WebDAV Shares via net.exe

Alerts on net.exe (net1.exe) commands that mount an HTTP/WebDAV network share.

Windows New Service Creation via sc.exe

Flags sc.exe service creation commands containing create and binPath on Windows, excluding Dropbox-launched cases.

PowerShell Creates Windows Service via New-Service and -BinaryPathName

Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.

Windows Registry Persistence Indicators in Event Viewer Events.asp Links

Flags Windows registry entries that reference Event Viewer Events.asp redirection URLs, excluding known benign svchost/GPO templates.

Windows suspicious vsstrace.dll image load by uncommon executables

Alert on vsstrace.dll module loads from processes outside common Windows/system paths.

Windows Tomcat Log File Deletion Indicating Possible Forensic Evidence Destruction

Flags Windows file deletions matching Tomcat log paths and common Catalina/localhost access log filename patterns.

Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)

Alerts on Windows process launches with command lines containing Unicode U+202E to support right-to-left text obfuscation.

Windows: certutil.exe ExportPFX certificate export via -exportPFX flag

Flags certutil.exe executions on Windows that include the -exportPFX argument to export certificate material.

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.

Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.

Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags

Alerts on certutil.exe runs with URL/HTTP-related flags indicative of remote file download.

Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.