Sigma detection rules, expert-reviewed

Windows UAC bypass via changepk.exe launched from slui.exe with elevated integrity

Flags changepk.exe execution from slui.exe with High/System integrity to identify potential UAC bypass behavior on Windows.

Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters

Flags Windows executions of splwow64.exe where the command line ends at the executable with no parameters.

Windows UAC Bypass via WoW64 Logger DLL Hijack (Process Access Pattern)

Flags SysWOW64 process-access behavior with high granted access and unknown call traces consistent with a WoW64 logger DLL hijack UAC bypass.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

Windows Named Pipe Creation Matching EfsPotato-Style \\pipe\\srvsvc

Alerts on Windows named pipe creation events matching an EfsPotato-style PipeName pattern (\pipe\ and \pipe\srvsvc), excluding common benign contexts.

UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp

Flags file events where Temp\OskSupport.dll is targeted alongside DllHost.exe and Windows Media Player\osk.exe, consistent with a UAC bypass attempt.

Windows UAC Bypass via consent.exe with comctl32.dll file path pattern

Detects suspicious target path patterns involving consent.exe.@ and comctl32.dll consistent with UAC bypass staging.

Windows Office Applications Creating Executable/Script Files with Suspicious Extensions

Flags Office application processes creating .exe/.dll/.ps1 and other script or executable files on Windows.

Exchange Management: Certificate CSR exported to webserver or .aspx-named path

Flags Exchange CSR export commands that write request files to C$ and web-root paths or use an .aspx filename.

PowerShell Write-Hijack HackTool Creates .bat for DLL Hijack Execution (Windows)

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

Windows: Detect reg.exe Changing Screen Saver Registry Settings for .scr Payloads

Flags reg.exe command lines that modify HKCU desktop screensaver settings and configure a .scr screen saver payload.

PowerShell WMI Event Subscription Persistence via New-CimInstance

Finds PowerShell creating WMI __EventFilter and CommandLineEventConsumer objects for event-triggered persistence.

Windows PowerShell: Add-Content to $profile for Potential Persistence

Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.

Windows Procdump Process Execution

Alerts on execution of Sysinternals Procdump (32/64 variants) based on process creation image path.

Windows whoami.exe Execution from Suspicious Parent Processes

Alerts on whoami.exe runs where the parent process is not a typical shell or monitoring agent.