Sigma detection rules, expert-reviewed

Windows whoami.exe Renamed Execution via Mismatched OriginalFileName

Alerts when a renamed process still reports OriginalFileName as whoami.exe on Windows.

Windows Maldoc Process Injection via winword.exe CallTrace from LittleCorporal

Flags winword.exe process injection where the call trace matches LittleCorporal-generated Maldoc activity on Windows.

PowerShell ShellIntel Commandlet Abuse via ScriptBlock Logging

Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.

Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment

Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.

Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation

Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.

Windows AnyDesk Silent Installation via Command-Line Flags

Identifies AnyDesk being silently installed on Windows using --install, --start-with-win, and --silent command-line flags.

Windows esentutl Usage with /p Flag for Credential Access

Flags Windows executions of esentutl when used with the /p parameter to access credentials-related files.

Windows Registry: Tamper Protection Disabled in Microsoft Defender Features

Flags registry changes that set Microsoft Defender Tamper Protection to disabled (DWORD 0x0), excluding expected MsMpEng update activity.

Windows Registry: Disabling Windows Defender PUA Protection via PUAProtection DWORD

Flags registry changes that set Windows Defender PUAProtection DWORD to 0x00000000 to disable PUA protection.

Windows Registry: Disable Windows Defender Exploit Guard Network Protection via Policy Override

Alerts on registry policy changes that override Exploit Guard Network Protection settings for Windows Defender.

Windows process access matching Cobalt Strike BOF injection call trace

Flags suspicious Windows process access consistent with CobaltStrike BOF injection using ntdll/KERNELBASE call traces and high GrantedAccess.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse

Identifies Windows processes with command-line arguments consistent with ADCSPwn targeting ADCS and a specified port.

Windows Process Creation: Recon Data Export via Command Prompt Redirection

Alerts when recon-related Windows utilities are launched with command-line output redirected to temp locations.