Sigma detection rules, expert-reviewed

Windows: InfDefaultInstall.exe .inf Execution

Flags Windows process executions of InfDefaultInstall.exe that include an .inf argument in the command line.

Windows PowerShell Module Creation With RemoteFXvGPUDisablement ModuleContents

Flags PowerShell module creation where ModuleContents includes Get-VMRemoteFXPhysicalVideoAdapter.

Windows PowerShell ModuleContents Set to Get-VMRemoteFXPhysicalVideoAdapter

Alerts on PowerShell module creation embedding Get-VMRemoteFXPhysicalVideoAdapter, a potential precursor to RemoteFXvGPUDisablement.exe abuse.

Windows Uninstall CrowdStrike Falcon Sensor via WindowsSensor.exe /uninstall /quiet

Flags Windows processes uninstalling CrowdStrike Falcon Sensor using WindowsSensor.exe with /uninstall and /quiet.

Windows Process: SyncAppvPublishingServer.exe Executes PowerShell via PowerShell-encoded command

Alerts when SyncAppvPublishingServer.exe is launched with a command-line pattern indicative of PowerShell code execution.

Windows Process Injection via Mavinject Using INJECTRUNNING Flag

Alerts on Windows process creation using Mavinject with /INJECTRUNNING, indicative of DLL injection into a running process.

Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.

Windows DNS Queries for IP Lookup Service Domains from Non-Browser Processes

Flags suspicious DNS lookups to IP-check API domains on Windows when they come from non-browser executables.

Windows Process Creation: MpCmdRun.exe Removing All Windows Defender Definitions

Flags MpCmdRun.exe launched to remove all Windows Defender definition files.

Windows Registry Defender Exclusions Path Set (Microsoft\Windows Defender\Exclusions)

Identifies registry updates that reference the Windows Defender Exclusions path, indicating potential defense impairment.

Windows Defender Exclusions Added via Windefend (Event ID 5007)

Alerts on Windows Defender exclusion additions based on windefend Event ID 5007 configuration change events.

Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings

Flags Defender tamper protection blocks to disable key Microsoft Defender Antivirus and real-time protection settings.

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

Windows reg.exe Run Key Modification for Persistence via Process Creation

Alerts on reg.exe commands that add values to Windows Run registry keys, a common persistence technique.