Sigma detection rules, expert-reviewed

Windows LSASS Process Clone Execution Observed

Alerts on process creation where LSASS creates a new LSASS clone, which may indicate credential dumping activity.

Windows extrac32.exe CAB extraction via Alternate Data Stream execution

Flags Windows executions of extrac32.exe that target a .cab and include an alternate data stream path indicator.

Windows Diantz.exe Command-Line ADS CAB Creation

Flags Diantz commands that create or reference a .cab using an Alternate Data Stream (ADS) pattern on Windows.

Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder

Alerts on Visual Studio–staged dump64.exe masquerading, potentially indicating an attempt to bypass Windows Defender AV.

Windows ConfigSecurityPolicy.EXE Used for HTTP/FTP Arbitrary File Transfers

Alert when ConfigSecurityPolicy.exe runs with ftp/http/https URLs in the command line, indicating potential file transfer abuse.

Windows PowerShell Clears Console History via Clear-History

Flags PowerShell attempts to clear or delete console/PSReadline command history to hinder command forensics.

Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths

Alerts on rundll32.exe loading shell32.dll with Control_RunDLL from AppData/Temp/user paths.

Windows CertReq -Post Download Attempt via HTTP

Flags certreq.exe executions using -Post -config and HTTP content retrieval indicators.

Windows bash.exe Launched with -c for Indirect Inline Command Execution

Alerts on Windows processes starting bash.exe with -c, indicating inline command execution.

Windows: aspnet_compiler.exe Execution Detection

Detects execution of aspnet_compiler.exe from Windows .NET Framework directories, which can be abused to compile and run C#.

Windows DNS Queries Triggered by DesktopAppInstaller AppInstaller.EXE

Identifies DNS lookups performed by Windows AppInstaller.EXE when initiating ms-appinstaller package installation from a URL.

Windows PsExec/PAExec Command-Line Flags Escalating to LOCAL SYSTEM

Flags in PsExec/PAExec command lines requesting LOCAL SYSTEM execution are matched via process creation command-line telemetry.

Windows process access to LSASS.exe with suspicious GrantedAccess flags

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.