Sigma detection rules, expert-reviewed

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Alerts on suspicious .dll file creation by Office/cmd/scripting processes in AppData and OneDrive/Teams/Slack/VS Code directories.

Windows Process Execution: SafetyKatz HackTool (SafetyKatz.exe)

Alerts when a process running SafetyKatz.exe is created, using image path and embedded file metadata.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

PowerShell Set-Acl targeting Windows folder paths on Windows

Flags PowerShell Set-Acl commands that modify ACLs for Windows folder paths, often using FullControl/Allow.

PowerShell Set-Acl Script Execution Changes File or Folder Permissions on Windows

Flags PowerShell commands using Set-Acl (-AclObject and -Path) to alter Windows file or folder permissions.

PowerShell Set-Service SecurityDescriptorSddl DACL Modification for Windows Services

Detects PowerShell Set-Service commands with SecurityDescriptorSddl SDDL patterns that modify Windows service DACLs.

Windows PowerShell Set-Service SDDL Usage to Hide Services

Flags pwsh Set-Service commands that set a SecurityDescriptorSddl to hide a Windows service from other tools.

PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services

Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.

Uncommon Applications Access Windows DPAPI Master Key Files

Alerts on unusual process access to Windows DPAPI master key files under Microsoft\Protect.

Windows Credential History File Access by Uncommon Applications

Alerts on CREDHIST file access from unexpected application images, indicating potential credential history theft.

Windows Security Event 5136: msDS-KeyCredentialLink Shadow Credential Added to AD Object

Alerts on AD attribute changes adding to msDS-KeyCredentialLink via Windows Security EventID 5136, consistent with shadow credential additions.

Windows process execution: wermgr.exe running outside standard system directories

Alerts when wermgr.exe is launched from a non-standard directory on Windows.

Windows Process Creation: Suspicious Child Process Spawned by Wermgr.EXE

Alerts on suspicious children spawned by wermgr.exe using common execution utilities, with a rundll32 WerConCpl exclusion.

Windows Security Logoff Events (Event ID 4634/4647)

Identifies Windows user logoff using Security Event IDs 4634 and 4647.