Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

Alerts when explorer.exe launches a .lnk and the command line contains suspicious whitespace padding used to hide extended arguments.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Process Creation: AdFind.exe Execution for Active Directory Recon

Alerts on Windows execution of AdFind.exe based on image/name and known imphash values indicative of AD reconnaissance.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows File Events: Suspicious WDAC Policy File Creation by Non-Excluded Processes

Alerts on WDAC-related policy files created under CodeIntegrity, excluding known deployment tools and scripts.

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

Windows file creation of executable/script files in \Users\Public

Alerts on Windows file creation in \Users\Public\ with potentially malicious script/binary extensions.

Windows: Clfs.sys Loaded from Suspicious Process Image Paths

Alerts when clfs.sys is loaded by a process running from user/temp/perflogs-style suspicious paths on Windows.

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Detects registry changes to Windows Event Log ChannelAccess SDDL, which can limit event log visibility or control.