Sigma detection rules, expert-reviewed

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

PowerShell Downgrade Attempts via -Version 2 on Windows Process Creation

Alerts on PowerShell executions specifying a -Version 2 argument, consistent with potential downgrade attempts.

Windows Desktop.ini Accessed by Uncommon Process

Alerts when unexpected processes create or access Desktop.ini, which can be abused to change how Explorer displays folder contents.

Windows Process Execution of .SettingContent-ms Command Line

Flags Windows processes whose command lines reference .SettingContent-ms, a potential trigger for setting-based execution.

Windows: Alert on Uncommon Child Process Executed from Appvlp.exe

Alerts on unusual child processes created by Appvlp.EXE on Windows, indicating potential command execution abuse.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

Windows Registry: TrustRecords key modification indicating macro-based initial access

Flags Windows registry writes to Security\Trusted Documents\TrustRecords, a signal consistent with macro-enabled initial access.

Windows: Office Application Loads VBE VBA DLLs via Image Load Events

Flags Office apps loading VBA-related VBE DLLs, a strong indicator of VBA macro execution.

Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Alerts when an Office app loads a .NET DLL from the GAC_MSIL directory.

Windows: CLR DLL Loaded by Office Applications

Alerts when Excel, Word, Outlook, PowerPoint, Publisher, or OneNote loads clr.dll on Windows.

Windows Office Apps Loading .NET Assembly DLLs from C:\Windows\assembly

Alerts when Office applications load DLLs from C:\Windows\assembly\ via image load events.

Windows Process Memory Dump via comsvcs.dll using rundll32

Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.

Windows Process Creation: Sticky Keys Backdoor via sethc.exe Replacement

Flags forced replacement of C:\Windows\System32\sethc.exe with cmd.exe consistent with a Sticky Keys backdoor.