Sigma detection rules, expert-reviewed

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders

Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.

Windows fsutil.exe Suspicious USN Journal and File Zeroing Parameters

Alerts when fsutil.exe is run with USN journal deletion/creation or setZeroData-style file zeroing commands.

Windows Registry: Enable WDigest UseLogonCredential (Use clear-text logon credential setting)

Flags registry writes that enable WDigest UseLogonCredential, turning on potential clear-text credential storage.

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Windows Named Pipe Created for PowerShell PSHost Instance

Alerts on named pipe creation with a \PSHost prefix, indicating PowerShell host-related activity.

Windows Named Pipe Creation: Alternate PowerShell Host via \PSHost

Alerts on creation of \PSHost named pipes to identify alternate PowerShell host usage via Windows pipe events.

Windows: WinRM inbound network connections to ports 5985/5986 for PowerShell remoting

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

Windows Suspicious Debugger Registration via Image File Execution Options

Alerts on Windows attempts to set Image File Execution Options debuggers for logon screen binaries via command-line arguments.