Every published rule

Windows Registry: New AppCompatFlags custom shim databases targeting system processes

Alerts on Windows registry writes to AppCompatFlags Custom shim paths targeting common system processes.

Windows sdbinst.exe Installing Shim Database with Uncommon Extension

Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.

Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll

Alerts when VMMap loads an unsigned dbghelp.dll from C:\Debuggers, suggesting DLL sideloading on Windows.

Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths

Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.

Windows: Alert on wget.exe downloading files from an IP with output flags

Flags Windows wget.exe usage to download HTTP URLs from IPs and write outputs to script/binary extensions.

Windows: curl.exe Local File Read via file:/// Command Line

Flags curl.exe runs that include file:/// to access local files on Windows.

Windows: Curl.exe Insecure Proxy/DOH Transfer Flags

Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.

Suspicious curl.exe File Downloads From Direct IP Addresses on Windows

Alerts on Windows curl.exe commands downloading from an IP address with HTTP/S and suspect file extensions.

Windows Process Execution: curl.exe with Custom User-Agent Header

Flags Windows executions of curl.exe that include a User-Agent header in the command line.

Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar

Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.

Windows Terminal settings.json modified by uncommon process

Alerts on Windows Terminal settings.json changes made by an uncommon command-line or script host process.

Windows Sysmon FileExecutableDetected (Event ID 29) Alerts on New Executable Files

Alerts on any Sysmon Event ID 29 indicating a new monitored executable file was created on Windows.

Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows

Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

Windows netsh.exe Advanced Firewall Rule Set Modification

Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Alerts when cmd.exe runs a one-liner that includes both ping and copy with expected options.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows DLL Sideloading: CCleanerReactivator.dll Loaded from CCleaner Directories

Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.