Sigma detection rules, expert-reviewed

Windows File Creation: System DLL Named .dll in Uncommon Locations

Alerts on creation of .dll files named like system DLLs in unexpected Windows directories.

Windows DNS Queries to azurewebsites.net From Non-Browser Processes

Alerts on DNS queries to azurewebsites.net from processes other than common browsers, using Windows DNS query and process image telemetry.

Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains

Alerts on initiated outbound connections from Windows hosts to LocaltoNet/.localtonet.com tunneling domains.

Windows: Suspicious Qemu execution with low-memory and network-tunneling flags

Alerts on Windows Qemu command lines using low -m values plus -netdev/connect= and -nographic.

Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)

Alerts when Windows Recall is enabled by setting the DisableAIDataAnalysis policy value to 0.

Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value

Flags deletion of WindowsAI\DisableAIDataAnalysis policy value indicating Windows Recall may be enabled.

Windows Recall Enabled via reg.exe Registry Changes (Windows)

Flags reg.exe commands that delete or set DisableAIDataAnalysis to 0 under WindowsAI to enable Windows Recall.

Windows Executable Connects to portmap.io Domain Over Network

Alerts when a Windows process initiates a connection to a .portmap.io destination hostname.

Suspicious Web Browser Launch from PDF/Office Reader on Windows over HTTP(S)

Alerts when Acrobat/Office/PDF readers launch common browsers with HTTP(S) URLs, excluding known Microsoft and Foxit redirect patterns.

Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS

Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.

Windows Network Connections to Cloudflared Tunnel Domains

Alerts when a Windows process initiates outbound connections to Cloudflared tunnel domain hostnames.

Windows: File Creation by mysqld.exe With Script/Executable Extensions

Alerts on file creation by mysqld.exe producing .bat/.exe/.ps1/.vbs and other executable or script file types on Windows.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

Windows Registry: UAC PromptOnSecureDesktop Disabled

Detects setting UAC PromptOnSecureDesktop to 0 via Windows registry policy, disabling secure desktop for UAC prompts.