Sigma detection rules, expert-reviewed

Windows Registry: Uncommon Microsoft Office Trusted Location Path Added

Alerts on registry changes adding non-standard Microsoft Office Trusted Location paths that could undermine macro security.

Windows Registry TrustRecords Change for Macro-Enabled Documents in Suspicious Paths

Alert on Windows registry changes to Office TrustRecords where trusted-document paths fall in suspicious directories.

Windows: Office Executable Running a Document from Trusted Template/Startup Paths

Alerts when Office apps are launched with command lines pointing to documents under Office template/Startup paths.

Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality

Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.

Windows ShellDispatch.dll DLL Sideloading via Image Load Monitoring

Alerts on suspicious loads of ShellDispatch.dll on Windows when not occurring in expected temp directories.

Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

Windows Security 4719: Important Audit Policy Categories Disabled

Alerts on Windows Security 4719 indicating auditing was disabled for important security event subcategories.

Windows Virtual Smart Card Created Using TpmVscMgr.EXE

Flags execution of Tpmvscmgr.exe with a create command, indicating creation of a new virtual smart card.

Windows: Detect lodctr.exe Rebuild (-r) Performance Counter Values

Flags lodctr.exe executions with -r, indicating attempts to rebuild performance counter registry values.

Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence

Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.

Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence

Flags VMwareToolBoxCmd.exe use of 'script' and 'set' parameters consistent with VM state–based persistence.

Windows DLL Sideloading: waveedit.dll Loaded by Nero WaveEditor

Alerts when waveedit.dll is loaded from an unexpected path, suggesting possible DLL sideloading on Windows.

Windows Registry: ClickOnce Trust PromptingLevel Set to Enabled for Multiple Locations

Alerts on Enabled ClickOnce trust prompting registry changes for Internet and related locations.

Suspicious Child Process Spawned by ClickOnce Application (Windows)

Alerts when a ClickOnce app under AppData\Local\Apps\2.0\ spawns common script/tool executables.

Windows: Uncommon Child Processes Spawned by SndVol.exe

Alerts when SndVol.exe launches unusual child processes, using Windows process creation logs.