Sigma detection rules, expert-reviewed

Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

Alerts on deletion of AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI, potentially indicating AMSI inspection impairment.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.

Windows Sysmon Configuration Event Where Sysmon Stops

Alert on Sysmon status showing a stop event concurrent with a Sysmon configuration state change.

Windows Sysmon error events indicating service configuration update failures

Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.

Windows Process Creation: SDelete Used for File Overwrite

Alerts when sdelete.exe runs in a way consistent with file overwrite to impede forensic recovery.

Windows WMI Shadow Copy Deletion via PowerShell

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

Windows Rundll32 Loads DLL Export StartNodeRelay (F-Secure C3)

Flags rundll32.exe launching a DLL that references the StartNodeRelay export in its command line.

Windows Rundll32 Used to Start Cobalt Strike DLL Load via StartW

Alerts on rundll32.exe command lines that include a .dll and StartW function, consistent with Cobalt Strike DLL loading.

Windows Security Event 4663: ISO CD-ROM device mount activity

Alerts on Windows file-access events consistent with ISO mounting by activity under \\Device\\CdRom.

Windows rundll32.exe Started Without Command-Line Parameters

Alerts on Windows process launches of rundll32.exe with no parameters, excluding likely benign parent paths.

Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent

Alerts when regedit.exe is launched by TrustedInstaller.exe or ProcessHacker.exe.

Windows Service Control Manager: ProcessHacker service runs as LocalSystem

Flags Windows service installs for ProcessHacker-prefixed services running as LocalSystem.

Windows: Rclone Configuration File Creation via rclone config path

Alerts on creation of rclone config files under a Windows user profile path.

Windows DNS Queries for userstorage.mega.co.nz Subdomain

Alerts on DNS queries referencing MEGA userstorage subdomains from Windows hosts.

Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike

Alerts on Windows 7045 service installs with ImagePath patterns consistent with Cobalt Strike-style PowerShell and execution.