Sigma detection rules, expert-reviewed

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

Windows: CertOC.exe certificate utility loading a DLL via -LoadDLL

Flags CertOC.exe launching with -LoadDLL to load a specified DLL on Windows.

Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

Flags PowerShell script block text indicating WindowStyle set to Hidden, suggesting concealed execution.

PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass

Alerts when PowerShell sets execution policy to Unrestricted or bypass, indicating weakened script execution controls.

Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion

Flags registry deletions that remove Windows RDP client connection history from Terminal Server Client MRU and Servers keys.

Windows PowerShell: Disable Windows Firewall Profile via Set-NetFirewallProfile

Flags PowerShell commands that disable one or more Windows Firewall profiles via Set-NetFirewallProfile -Enabled $false.

Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries

Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.

Windows Named Pipe Access to ADFS/WID Database by Uncommon Process

Alert on named pipe creation to the AD FS WID SQL query endpoint when initiated by uncommon processes.

Windows: Suspicious Driver Installation via pnputil.exe

Flags pnputil.exe command lines indicating driver install/add actions targeting .inf files on Windows.

Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:

Alerts on DataSvcUtil.exe runs with /in:, /out:, and /uri: parameters that may indicate data exfiltration activity.

Windows Prefetch File Deletion via .pf File Removal

Flags deletion of .pf files in \\Windows\\Prefetch, a possible attempt to remove execution artifacts.

Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)

Alerts on Windows executions of rdrleakdiag.exe that request full or targeted memory dumps via /memdmp or /fullmemdmp.

PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)

Identifies PowerShell use of Get-StorageDiagnosticInfo with -IncludeLiveDump to trigger a live memory dump on Windows.