Sigma detection rules, expert-reviewed

Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

Alerts when csc.exe is launched from user/temp-like paths, indicating potential on-the-fly .NET compilation.

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

Windows: WmiPrvSE.exe Spawning a Child Process

Identifies child processes created by WmiPrvSE.exe on Windows, highlighting potential WMI-based execution attempts.

Windows Security: Non-System SeTakeOwnershipPrivilege granted on SCM database object

Flags non-system users requesting SeTakeOwnershipPrivilege on the SCM database object servicesactive in Windows Security 4674.

Windows Security: SysKey-related LSA Registry Key Access (4656/4663)

Alerts on access to LSA registry keys used to compute SysKey based on Windows Security handle and registry object events.

Windows Security Event 4656: Non-system handle failure to SCM database object

Alerts on failed SCM database handle requests for ServicesActive from non-system logons using Windows Security Event ID 4656.

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

Windows Security: Network Access to protected_storage (IPC)

Flags Windows network share access to protected_storage through IPC from Security event 5145.

Windows Security Event 4692 Detecting DPAPI Domain Master Key Backup Attempt

Flags Windows Event ID 4692 indicating an attempt to back up the DPAPI domain master key.

Windows: MMC spawning command-line executables

Flags cases where mmc.exe starts command-line tools like cmd, PowerShell, script hosts, or BITSADMIN.

Windows CMSTP UAC Bypass Attempt via Autoelevate COM Object DllHost Execution

Detects DllHost.exe spawning CMSTP-related autoelevate COM objects by matching known Processid values and high/system integrity.

Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Alerts on AD replication-related object access events where the requester is not a machine account.

Windows regsvr32 Executes DLL with Uncommon Extension in Command Line

Alerts when regsvr32.exe is launched with a DLL extension pattern that is not in the common list.