Sigma detection rules, expert-reviewed

Windows: AddInUtil.exe LoLBin Executed from Non-Standard Directory

Alerts when AddInUtil.exe (AddInUtil.exe) runs from an uncommon directory path on Windows.

Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs where AddInRoot/PipelineRoot command-line paths deviate from common VSTA locations.

Windows: Uncommon Child Processes Spawned by Addinutil.exe

Alerts when Addinutil.exe launches an uncommon child process, indicating potential proxy execution abuse.

Windows AddInUtil.exe Executed with Suspicious AddInRoot or PipelineRoot Parameters

Alerts on AddInUtil.exe runs using uncommon AddInRoot/PipelineRoot values targeting Temp, Desktop, Downloads, or public user paths.

Windows network connections initiated by AddinUtil.exe

Alerts on network connections initiated by Addinutil.exe, which is uncommon for this utility on Windows.

Windows: Diskshadow.exe Script Mode Execution from Suspicious File Paths

Alerts when diskshadow.exe runs with /s and a script path found in Temp/AppData/ProgramData/Users\Public-style directories.

Windows Diskshadow Script Mode Executes Script File with Uncommon .txt Extension

Alerts when diskshadow.exe runs with -s script mode and the script path/command includes an uncommon extension like .txt.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Windows: Headless Chromium Browser Execution via --headless

Alerts on headless Chromium-based browser launches on Windows using the "--headless" command-line flag.

Windows Process Creation: wmic.exe call terminate Attempt

Alerts on wmic.exe being executed with “call terminate”, indicating an attempt to terminate a process on Windows.

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Alerts on Windows process launches whose PE metadata matches curl.exe even when the executable image is renamed.

Windows Chromium Headless Execution with Mockbin/Mocky URL

Alerts when a Chromium-based browser runs headless on Windows with a mockbin-like URL in the command line.

Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts

Alerts on .dmp/.dump/.hdmp file creation by common Windows shells and scripting engines.

Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1

Flags registry changes that set SCHANNEL TLS 1.0/1.1 Enabled to 1 on Windows.

Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS

Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.