Sigma detection rules, expert-reviewed

Windows Security Event Add/Remove Computer Account (4741/4743)

Alerts on Windows domain computer account create/delete activity via Security event 4741 and 4743.

Windows: ssh.exe RDP tunneling to :3389 via SSH

Alerts on Windows process executions of ssh.exe that reference RDP port :3389 for SSH tunneling.

Port Forwarding via SSH.EXE on Windows

Flags Windows executions of ssh.exe using remote port forwarding (-R) based on process creation command-line content.

Windows Credential Manager Vault/File Access by Uncommon Application Images

Alerts on access to Windows credential/vault files by uncommon processes based on image path and file location.

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Alerts on Process Hacker being executed on Windows when process creation metadata or hashes match known indicators.

Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups

Flags PowerShell Get-LocalGroupMember usage targeting notable local group names in process creation logs.

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Flags Windows execution of PCHunter64/32.exe using image path plus PE metadata and known hashes.

Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters

Flags Windows executions of npc.exe with NPS server, vkey/password, or config=npc command-line parameters.

Windows Execution of IOX (iex/port forwarding) Tunnel/Proxy Tool via Process Creation

Alerts on Windows process creation for iox.exe with tunneling/proxy forwarding command-line parameters.

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.

Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.

Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)

Flags execution of gmer.exe on Windows when matched by known process hashes.

PowerShell PSAsyncShell Reverse Shell Activity via Script Block Logging

Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.

Windows Driver Load of Known Vulnerable Drivers by File Name

Alerts when Windows loads a driver whose filename matches a list of known vulnerable drivers.

Windows Malicious Driver Load Identified by Known Bad Driver File Names

Alerts when Windows loads a driver whose file name matches a curated list of known malicious/suspicious drivers.