Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Creation with Command Line (via process_creation)

This rule detects creates a scheduled task via commmand line.

Malicious Massive Processes Termination Burst (via process_creation)

This rule detects kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Suspicious Permissions Modification on a Network Share (via security)

This rule detects modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares.

GateDoor DLL Search Order Hijacking via WebView2Loader from MicrosoftEdging (via image_load)

This rule detects WebViewHost.exe loading a WebView2Loader.dll from the roaming MicrosoftEdging directory, the DLL search-order hijack GateDoor uses to run malicious code under a WebView2 host name. Because the legitimate loader ships inside vendor install paths, a WebView2Loader.dll executing from the user roaming profile is a reliable side-loading indicator.

Malicious Firewall Deactivation - PowerShell (via powershell)

This rule detects disabled the Windows Firewall to evade defense.

Masquerading Administrator Login Impersonation with Forged Golden Ticket (via security)

This rule detects used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.

Malicious Kerberos proxiable/S4U2self Ticket - CVE-2021-42278/42287 (via security)

This rule detects request a proxiable ticket. This action may trigger while attempting to identify a vulnerable target or using some offsensive Kerberos tools like Kerbrute, Impacket...

Malicious Service Creation - PowerShell (via powershell)

This rule detects create a service for persistence.

Malicious UAC Bypass via ms-settings Handler Hijack (via registry_set)

This rule detects creation of a command under HKCU ms-settings\shell\open\command, the registry hijack that fodhelper.exe and computerdefaults.exe follow to auto-elevate an attacker command without a UAC prompt. This ms-settings handler hijack is a privilege-escalation technique tracked in the Red Canary Threat Detection Report. Detecting the key modification surfaces a UAC-bypass being staged.

Malicious Event Log Clear Attempt - Command (via process_creation)

This rule detects clear the event logs.

Malicious Massive Remote Service Creation via Named Pipes - TChopper, CME (via security)

This rule detects remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.

Suspicious Windows Subsystem for Linux (WSL) Installation - Command (via process_creation)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

This rule detects creation of .kirbi files, the on-disk format Mimikatz and similar tools use when exporting stolen Kerberos tickets for pass-the-ticket and Kerberoasting attacks. Kerberos ticket theft tied to LSASS and credential abuse features in the Red Canary Threat Detection Report as a path to lateral movement and domain compromise. Because legitimate software rarely writes .kirbi files, their appearance is a high-fidelity indicator of credential theft.

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

This rule detects wmic.exe being used to enumerate host security and system information, such as querying installed antivirus products, operating-system details or running processes for situational awareness. WMI-based discovery is called out in the Red Canary Threat Detection Report as an early hands-on-keyboard step that informs an adversary's next moves. Detecting these reconnaissance queries surfaces post-compromise triage before escalation.

Renamed Regsvr32 or Rundll32 Loading a DLL With a Non-Standard Extension (via process_creation)

This rule detects regsvr32 or rundll32 loading a module that carries a disguised or non-standard extension such as .dat, .tmp, .png or .log from a user-writable directory, a masquerading pattern used by loaders like Qbot to hide their DLL payload. Proxy execution of renamed DLLs is documented in the Red Canary Threat Detection Report as a way to defeat extension-based controls. Detecting these disguised module loads surfaces the payload execution.