Sigma detection rules, expert-reviewed

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Alerts when Office app processes initiate outbound TCP/HTTP(S)/mail connections to non-private IPs, excluding common private and known provider ranges.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration

Alert on cscript/wscript running “.vbs -register” to register COM+ components, potentially leveraging register_app.vbs.

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

Windows Process Creation: PowerShell ExecutionPolicy Set to Bypass/Unrestricted

Alerts on PowerShell started with -ExecutionPolicy set to Bypass/Unrestricted, indicating a potentially insecure script execution posture.

Windows Process Creation: Command-Line Indicators of Crypto Mining

Alerts on Windows processes with command-line arguments matching common crypto miner pool and configuration indicators.

Windows Process Creation: Suspicious Command-Line Path Traversal Evasion Strings

Flags Windows command-line strings that look like “..\” path traversal evasion attempts, excluding known Google Drive and Citrix launcher patterns.

Windows Network Connections to Known Crypto Mining Pools

Flags Windows hosts making outbound connections to known cryptocurrency mining pool domains.

Windows Browser Process Creating VHD/VHDX Files via Download

Alerts when a Windows browser process creates files containing .vhd, indicating potential VHD/VHDX staging.