Sigma detection rules, expert-reviewed

Windows Registry Run Key Modification via winekey or team9 backdoor

Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.

Windows PsExec Execution Triggered by psexec.exe Process Creation

Flags process creation of PsExec (psexec.exe / psexec.c), a tool often used for remote execution and potential lateral movement.

Windows Credential Access via Reg Add in LSA Registry Paths

Alerts when reg add commands target LSA registry settings and scecli entries commonly abused for credential access.

Windows Process Creation: bitsadmin.exe BITS jobs with SetNotifyCmdLine or remote file additions

Alerts on bitsadmin.exe command lines using /SetNotifyCmdLine or /Addfile to execute after download or stage remote files.

Windows Image Load of PCRE.NET Package Temp Module Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

Windows Processes Creating PCRE.NET Temp Package Files

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.

Windows Registry Persistence via Office Test Startup Key

Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.

Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32

Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.

Windows Registry: Detect esentutl.exe activity under VSS service keys

Flags registry changes under VSS service keys when initiated by esentutl.exe, consistent with VSS-related abuse.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

Windows DLL image load: credui.dll loaded by an uncommon process

Detects credui.dll or wincredui.dll being loaded by a process other than common system binaries.

Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)

Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.

Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)

Alerts on VSSAudit security event source registration in Windows Security logs using Event IDs 4904/4905.

Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r

Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.