Sigma detection rules, expert-reviewed

PowerShell Module: Obfuscated Clip.exe launcher using cmd with clipboard download payload

Detects obfuscated PowerShell module commands that run cmd with clip.exe/clipboard payload formatting.

Windows System: Detects Service Control Manager spawning obfuscated PowerShell via VAR++ LAUNCHER

Flags newly created Windows services whose ImagePath contains cmd chaining and obfuscated PowerShell launcher indicators.

Windows System Service Control: Obfuscated cmd Launching clip.exe for PowerShell

Flags service creation (Event 7045) with obfuscated cmd ImagePath using clip.exe/clipboard PowerShell execution patterns.

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Identifies Windows Zerologon exploitation attempts tied to Kali-hosted activity and mimikatz-related keywords.

Windows Security 4697 Alert for Obfuscated PowerShell Invoke via VAR++ LAUNCHER

Alerts on obfuscated PowerShell launcher patterns in Windows service creation events (EID 4697) consistent with VAR++ LAUNCHER.

Windows Security Log: Obfuscated cmd Execution of clip.exe via PowerShell Clipboard Patterns (EID 4697)

Alerts on service creation (Windows 4697) with CLIP.exe command-line patterns that indicate obfuscated PowerShell execution.

Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)

Alerts when wuauclt.exe is executed with UpdateDeploymentProvider/RunHandlerComServer-related parameters indicative of proxy execution.

Windows WMIC process creation with suspicious command execution

Alerts on WMIC spawning new processes with command-line indicators of common execution/payload binaries on Windows.

Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)

Alert on regini.exe process executions whose command line contains an ADS-style colon pattern used for registry modification.

Windows: regedit.exe imports .reg via an alternate data stream (ADS)

Alerts when regedit.exe is used to import a .reg file using an alternate data stream pattern in the command line.

Windows Regedit Exports Registry Hives to Files

Flags regedit.exe command lines exporting SYSTEM/SAM/SECURITY hives from HKLM to files.

Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring

Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.

Windows Indirect Command Execution via Program Compatibility Assistant pcwrun.exe

Alerts on child processes spawned by pcwrun.exe, indicating indirect command execution via Program Compatibility Assistant.

Detect Obfuscated PowerShell Command Invocation via Stdin on Windows

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

Windows Process Creation: AtBroker.exe Launching Assistive Technology Apps

Alerts on Windows process starts of AtBroker.exe with "start" that don’t match known built-in accessibility parameters.