Sigma detection rules, expert-reviewed

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows DLL Sideloading: CCleanerReactivator.dll Loaded from CCleaner Directories

Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.

Windows DLL Sideloading via CCleanerDU.dll ImageLoad from CCleaner Folder

Alerts when CCleanerDU.dll is loaded, but the loading image is not CCleaner executables in standard install paths.

Windows Process Creation From Fake Recycle.Bin Directories

Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.

Windows: wordpad.exe Initiated Network Connections on Uncommon Ports

Alerts when wordpad.exe initiates outbound connections on destination ports outside common C2-related ports.

Windows Office Apps Initiating Network Connections to Non-Common Ports

Alerts on network connections initiated by Windows Office apps to destination ports not in the common port set.

Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders

Alerts on Windows file writes involving RECYCLERS.BIN\ or RECYCLER.BIN\ paths often used for staging.

Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations

Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.

Windows: Recon command output piped to findstr.exe

Alerts on Windows command lines running recon commands whose output is filtered with findstr.exe.

Windows process creation: WerFault.exe executed with -pr flag

Alerts when WerFault.exe is launched with the -pr argument, potentially indicating ReflectDebugger-based execution.

Windows PowerShell Decryption-Like Activity Involving .LNK File Processing

Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.

Windows Process Execution of curl.exe with --insecure Flag

Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.

Windows Registry: Uncommon Microsoft Office Trusted Location Path Added

Alerts on registry changes adding non-standard Microsoft Office Trusted Location paths that could undermine macro security.