Sigma detection rules, expert-reviewed

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Windows PortProxy Registry Key Modified for Port Forwarding

Alerts when PortProxy port-forwarding registry entries under the Windows TCP v4tov4 path are added or modified.

Windows: Detect execution of renamed megasync.exe (original MegaSync) via process creation

Flags process launches where megasync.exe appears under a renamed or nonstandard execution context based on process creation fields.

Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters

Flags LDAP search queries indicative of Active Directory reconnaissance/enumeration using Event ID 30 filter patterns.

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

Windows Registry: New TaskCache entry created by unusual process image

Alerts when TaskCache registry entries are created by processes other than a defined set of expected Windows binaries.

Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata

Alerts on process creation events consistent with running PurpleSharp.exe on Windows.

Windows: Process writes registry to disable storage write-protection

Alerts on Windows process command lines that appear to disable storage write-protection via registry modification.

Windows Registry Set—Custom Outlook Today Page for Persistence

Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.

Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache

Flags Outlook (outlook.exe) form file activity targeting local FORMS directories often used for persistence.

Windows Registry Changes for Outlook WebView Home Page URL Persistence

Alerts on Windows registry modifications affecting Outlook WebView home page URL settings.

Windows Registry: Microsoft Office Protected View Disabled via Security Policy Keys

Flags Windows registry updates that disable Microsoft Office Protected View for attachments, internet files, UNC paths, or unsafe locations.

Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.