Sigma detection rules, expert-reviewed

Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing

Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.

Windows DLL Load Trusted Path Bypass via Spoofed Directory Paths with Extra Space

Flags Windows DLL loads from spoofed "C:\Windows \\System32"-style paths with an extra space to indicate trusted-path bypass attempts.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters

Alerts on SharpSuccessor.exe command-line patterns indicative of Windows privilege escalation attempts.

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.

Windows Event Log: MSSQLSERVER$AUDIT alerts on DROP/ TRUNCATE destructive SQL statements

Flags audited MSSQL transactions that include DROP TABLE, DROP DATABASE, or TRUNCATE TABLE.

Windows DNS Queries to Malware Hosting and URL Shortener Domains

Alert on Windows DNS queries to domains tied to URL shorteners and malware hosting services.

Windows: TacticalRMM Agent Installed with API/Auth Flags Pointing to Remote RMM Server

Alerts when TacticalRMM agent starts with --api/--auth and identity flags consistent with connecting to a configured remote RMM server.

Windows PowerShell Obfuscated COM MSI Installation via WindowsInstaller.Installer

PowerShell spawning that uses WindowsInstaller.Installer COM with obfuscated strings to call InstallProduct and suppress UI.

Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Alerts on PowerShell runs of New-ADServiceAccount to create a delegated service account with -CreateDelegatedServiceAccount and -path.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

Windows reg.exe Registry Save/Export of Third-Party Credential Paths

Alerts on reg.exe save/export commands targeting registry keys tied to third-party credential data.

Windows: Deno writes files from remote HTTPS content into AppData

Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.