Sigma detection rules, expert-reviewed

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

PowerShell Get-ADUser Enumeration Using UserAccountControl DONT_REQ_PREAUTH Flag

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

Windows Remote Thread Creation Targeting Uncommon System Image Processes

Alert on Windows remote thread creation events targeting a predefined list of uncommon processes by image path.

Windows schtasks.exe Create Executes File from AppData\Local

Alerts on schtasks.exe creating tasks that run payloads from C:\Users\<user>\AppData\Local.

Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping

Alerts on Windows command lines using for/foreach loops that also run nslookup or ping, consistent with host scanning.

Windows HackTool Process Patterns for CrackMapExec LSASS Dumping

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.

Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling

Detects suspicious Windows processes that reference NTDS.DIT/SYSTEM hive dumping or staging via common NTDS tooling and scripts.

Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns

Alerts on Windows file creates using common NTDS-DIT dump/exfiltration filename suffixes like \All.cab and .ntds.cleartext.

Windows Process Creation: OfflineScannerShell.exe mpclient.dll DLL Sideloading Risk

Detects OfflineScannerShell.exe launched with an unexpected current directory that could enable mpclient.dll sideloading.

Windows Process Creation: Replace.exe with -a argument

Detects Replace.exe executions that include the -a argument, which may be used for file replacement.

Windows Suspicious UltraVNC Command Line With Auto-Reconnect Flags

Alerts on UltraVNC execution using -autoreconnect with -connect and -id in the Windows command line.

PowerShell Base64 Encoded MpPreference Command Lines for Windows Defender Modification

Detects PowerShell Base64 command lines referencing Add-MpPreference/Set-MpPreference to modify Microsoft Defender AV settings.

Windows Hacktool Execution Flagged by Imphash in Process Creation

Alerts on Windows process executions where the import hash matches known hacktool binaries, even if renamed.