Sigma detection rules, expert-reviewed

Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)

Flags ASR blocks (windefend 1121) of process creations tied to WMI (wmiprvse.exe) or PSExec (psexesvc.exe).

Windows Sysmon Operational Channel Reference Deleted via Security Event

Detects Security log events showing Sysmon Operational channel being disabled via channel reference deletion-like changes.

Windows PowerShell Command Lines Containing [char]0x or (WCHAR)0x Obfuscation Syntax

Identifies PowerShell execution command lines using suspicious [char]0x or (WCHAR)0x encoding patterns.

Windows Process Execution of DIT Snapshot Viewer (ditsnap.exe)

Alerts on execution of the DIT snapshot viewer tool ditsnap.exe on Windows.

Windows Process Execution: Copy From System Directories to Other Locations

Detects cmd.exe, PowerShell, and copy utilities copying files from System32/SysWOW64/WinSxS to other locations on disk.

Windows desktopimgdownldr Suspicious URL and Registry Modification via Command Line

Flags desktopimgdownldr command lines indicating potential external file download or personalization registry deletion.

Windows curl.exe Suspicious Download to Local File Paths

Flags curl.exe executions on Windows that appear to download to local files in suspicious directories with risky file extensions.

Windows Desktop Image Downloader Targeting Lock Screen Images with Suspicious File Types

Alerts on desktopimgdownldr-style lock screen image target writes to non-system paths with suspicious filename characteristics.

Windows Registry Printer Driver Installations with Empty Manufacturer Field

Alerts on Windows registry printer driver environment updates where Manufacturer is set to empty.

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Alerts on AppLocker event IDs showing blocked execution of apps, scripts, DLLs, MSI, or packaged apps.

Windows Security Log: Denied Remote Desktop Logon (Event ID 4825)

Flags Windows denied RDP connection attempts from users lacking permission to log on remotely (Event ID 4825).

Windows Registry Event Triggered by RedMimicry Winnti Playbook (HTMLHelp\data)

Alerts on Windows registry events targeting HKLM\SOFTWARE\Microsoft\HTMLHelp\data associated with the RedMimicry Winnti playbook.

Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)

Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.

Suspicious WSMAN COM Provider Usage Without PowerShell Host (Windows)

Alerts on WSMAN COM provider activity where the host application is not PowerShell.exe in PowerShell Classic logs.

Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)

Detects Windows file drops of specific DLLs and a Windows Temp batch filename pattern associated with a Winnti dropper scenario.