Sigma detection rules, expert-reviewed

PowerShell on Windows adding Windows capabilities via Add-WindowsCapability

Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.

Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)

Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.

Windows IIS appcmd Creating GlobalRules URL Rewrite Configuration

Flags appcmd.exe commands that modify IIS global URL rewrite globalRules and commit the configuration.

Windows Capability Added via PowerShell Add-WindowsCapability (OpenSSH)

Flags PowerShell commands that add Windows capabilities, specifically OpenSSH, via Add-WindowsCapability in logged script blocks.

Windows PowerShell Active Directory Module Import for Enumeration

Detects PowerShell importing Microsoft.ActiveDirectory.Management.dll with Import-Module, often seen during AD enumeration.

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

Windows: Detect Aruba Netsvc DLL Search Order Hijacking via arubanetsvc.exe Loaded DLLs

Flags arubanetsvc.exe loading targeted DLLs outside standard system paths, suggesting possible DLL search order hijacking.

Windows: OneNote .one/.onepkg File Creation in Suspicious Locations

Flags creation of OneNote attachment files (.one/.onepkg) in temp/public-style paths on Windows.

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact

Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

Windows driverquery.exe Process Execution Detection

Alerts on Windows executions of driverquery.exe (drvqry.exe) used to enumerate installed drivers, with parent-process exclusions to reduce duplicates.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Alerts on successful RDP (LogonType 10) from a non-private, non-local source IP in Windows Security Event 4624.