Sigma detection rules, expert-reviewed

Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings

Alerts on PowerShell ScriptBlock content referencing Group Policy policy keys and specific security policy value names.

Windows Process Execution of HandleKatz LSASS Dumper (loader.exe)

Flags HandleKatz-style loader.exe executions that dump LSASS into obfuscated .obf files using --pid and --outfile.

Windows driver load of HackSys Extreme Vulnerable Driver (HEVD.sys) via image hash

Flags Windows systems when HEVD driver \HEVD.sys is loaded with known IMPHASH values.

Windows Malicious Driver Load by Known Hashes

Alerts on Windows driver loads matching known malicious driver hashes (MD5/SHA1/SHA256/IMPHASH).

Windows Executable Connections to Dead Drop Resolver Domains Excluding Common Browsers

Flags non-browser Windows executables making outbound connections to known dead-drop resolver domain patterns.

Windows DLL sideloading via third-party application directories (ImageLoad event)

Flags Windows ImageLoad events for specific DLL sideloading candidates tied to Lenovo and Toshiba software.

Windows: Detect Microsoft Office DLL sideloading via ImageLoad of outllib.dll from nonstandard path

Alerts on outllib.dll loads from non-standard locations rather than typical Microsoft Office directories.

Windows Chrome Frame Helper DLL Sideloading via Image Load

Alerts when chrome_frame_helper.dll loads from an unexpected location on Windows, indicating possible DLL sideloading.

Windows DLL Sideloading Using Antivirus/Vendor DLLs Based on Loaded Image Names

Alerts on suspicious DLL loads matching known antivirus/security component DLL names when not from expected vendor paths.

Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows

Alerts when Sysmon blocks an attempted executable execution due to FileBlockExecutable policy violations.

PowerShell Write-EventLog with -RawData Flag

Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.

Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers

Alerts on Windows command lines invoking mshtml.dll RunHTMLApplication (via #135) with path traversal markers.

Windows Firewall rule deleted via netsh.exe command line

Flags netsh.exe executions that contain Windows Firewall rule deletion commands.

Windows DLL Sideloading: System DLL Names Loaded from Non-Standard Paths (ImageLoad)

Alerts when Windows image loads DLL names typically found in system locations, excluding common benign paths to reduce false positives.

Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load

Flags rundll32.exe loading a renamed comsvcs.dll module consistent with process memory dumping behavior on Windows.