Sigma detection rules, expert-reviewed

Windows regsvr32 Usage of /i Without /n Flag

Alerts on regsvr32.exe invocations using /i: without the usually paired /n flag.

Windows: Explorer factory invocation causing process tree break

Alerts on process creation command lines showing explorer.exe factory and /root usage consistent with an explorer-based process tree break.

Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension

Alerts on Windows processes whose paths/command lines use misleading double extensions ending in .exe to cloak executable execution.

Windows Security Log LSASS Access by Non-Computer Account Process

Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.

Windows Security Event 4662 Detects DPAPI Domain Backup Key Extraction from Domain Controllers

Detects read access to LSA secret DPAPI domain backup key objects in Windows Event ID 4662.

Windows: Suspicious userinit.exe Child Process Creation

Alerts when userinit.exe spawns an atypical child process, excluding known benign explorer and netlogon command-line patterns.

Windows Process Creation: Flag Renamed Execution of Common LOLBins Based on OriginalFileName

Alerts when a renamed process executes and Sysmon OriginalFileName matches common Windows LOLBins, suggesting defense-evasion rename behavior.

Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools

Flags Windows executions where Sysmon OriginalFileName matches common tools but the process Image name ends differently.

Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Flags Windows 4624 successful logons consistent with Pass-the-Hash activity using NtLmSsp or seclogo.

Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names

Alerts when Java Update Scheduler descriptions are used to execute a process ending with \jusched.exe on Windows.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.