Sigma detection rules, expert-reviewed

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.

Windows Security EID 4697: mshta Used to Run Obfuscated VBScript PowerShell

Detects service creation where the binary path includes mshta plus VBS/automation indicators consistent with script-based obfuscation.

Windows Security 4697: Obfuscated PowerShell via use of Clip.exe from scripts

Alerts on EID 4697 service installations where the service file name matches Clip/clipboard indicators tied to obfuscated PowerShell.

Windows regini.exe Execution Leading to Registry Key Changes

Alerts on Windows executions of regini.exe that can import registry changes from text files.

Windows net.exe Unmount Share (/delete) Execution

Alerts on net.exe/net1.exe commands that include "share" and "/delete", indicating share unmount/removal on Windows.

Windows Process Dumping via sqldumper.exe with 0x0110 Command-Line Flags

Alerts on sqldumper.exe executions with command-line dump parameters indicative of process dumping.

Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe

Flags Windows process executions that invoke Pester-related help/commands via PowerShell or cmd, consistent with Pester.bat usage.

Windows Process Execution: Obfuscated PowerShell Invocation Using mshta with VBScript CreateObject

Flags Windows process command lines containing an obfuscated PowerShell+MSHTA VBScript execution pattern.

PowerShell share removal via Remove-SmbShare or Remove-FileShare on Windows

Flags PowerShell commands that remove SMB or file shares through Remove-SmbShare/Remove-FileShare.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

UAC Bypass Using wsreset.exe Registry Command Path (Windows)

Identifies registry TargetObject values associated with a wsreset-style UAC bypass execution command path on Windows.

Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)

Alerts when Xwizard.EXE runs with RunWizard plus a GUID-like argument on Windows, consistent with COM execution usage.

Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.