Sigma detection rules, expert-reviewed

Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)

Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution

Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.

Windows OpenConsole LOLBIN Execution via Process Creation

Alerts when OpenConsole.exe runs (outside a specific Windows Terminal path), potentially used to bypass application whitelisting.

Windows Registry: Enable ScriptedDiagnostics TurnOffCheck DWORD via Policies

Flags registry policy enabling ScriptedDiagnostics TurnOffCheck (DWORD 0x00000001) on Windows.

Windows: Execution of Pcalua.exe with -a Argument

Flags Pcalua.exe executions containing " -a" that may indicate indirect command execution on Windows.

Windows forfiles.exe Execution with /c Flag Command Proxying

Flags forfiles.exe executions that include the /c flag, indicating potential indirect command execution.

Windows conhost.exe Path Traversal in Process Command Line

Detects Windows conhost.exe command lines containing '/../../' path traversal indicators.

Windows msdt.exe execution using PCWDiagnostic.xml answer file

Alerts on msdt.exe launched with PCWDiagnostic.xml and an answer-file argument, excluding cases from pcwrun.exe.

Windows: Indirect execution of pcwrun.exe using path traversal-style command line content

Detects pcwrun.exe spawning with '../' in the command line, indicating potential indirect execution abuse.

Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL

Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.

Windows: GUP Utility Spawns Commands from Explorer via Notepad++ Updater

Flags Notepad++ updater-launched GUP activity that causes explorer.exe to execute with notepad++ in the command line.

Windows: New Notepad++ plugins DLL written outside gup.exe

Alerts on creation of Notepad++ plugin DLLs by a process other than gup.exe, suggesting possible persistence via custom plugins.

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.