Sigma detection rules, expert-reviewed

Windows Process Creation: Node.js Executions from Adobe Creative Cloud

Flags Windows executions of Adobe Creative Cloud’s bundled node.exe, excluding typical JS resource paths.

Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line

Alerts on suspicious command-line usage of DumpMinitool.exe on Windows, leveraging process creation Image, OriginalFileName, and command-line text.

Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping

Identifies Windows executions of DumpMinitool.exe variants with dump options via process creation telemetry.

Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.

Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

Alerts on registry certificate-store writes adding new Root/CA/AuthRoot certificates as binary blobs.

Windows Registry Key Change Disabling System Restore

Detects registry writes that disable Windows System Restore via policy/config keys set to DWORD 0x00000001.

Windows Registry Service Persistence via SafeBoot Control Keys

Flags Windows registry writes that configure a service to load in Safe Mode (SafeBoot Minimal/Network).

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.

Windows Registry Change Disabling Hidden and System File Display

Detects registry writes that disable Windows Explorer showing hidden/system files by setting Hidden and ShowSuperHidden to 0x0.

Windows PowerShell: Suspicious GetTypeFromCLSID and ShellExecute usage

Flags PowerShell script blocks that use GetTypeFromCLSID followed by ShellExecute.

Windows fsutil.exe Drive Enumeration via Process Execution

Flags fsutil.exe process launches with command lines referencing connected drive enumeration.

Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines

Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.

Windows PowerShell Download and Execution Cradles

Flags PowerShell commands that download remote content and immediately execute it using IEX/Invoke-Expression.

Windows: reg.exe Registry Tampering of Windows Defender Policy Keys

Detects reg.exe adding Defender DWORD policy values to disable or suppress multiple protection features via Windows registry.