Sigma detection rules, expert-reviewed

Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading

Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.

Windows DLL Sideloading via mfdetours.dll using mftrace.exe

Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.

Windows ImageLoad DLL Sideloading: EACore.dll

Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.

Windows DLL sideloading via AVKkid.dll image loads

Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.

Windows Registry Key Abuse via Provisioning Commands for Proxy Binary Execution

Flags registry modifications to the Provisioning Commands key path that may enable indirect execution via Provlaunch.exe.

Windows Amazon SSM Agent Process Creation with Registration and Code Parameters

Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.

Windows AppCompatFlags InstalledSDB New Shim Database in Non-Default Path

Flags persistence attempts where a shim database is registered via InstalledSDB with a non-default DatabasePath on Windows.

Windows Registry: New AppCompatFlags custom shim databases targeting system processes

Alerts on Windows registry writes to AppCompatFlags Custom shim paths targeting common system processes.

Windows sdbinst.exe Installing Shim Database with Uncommon Extension

Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.

Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll

Alerts when VMMap loads an unsigned dbghelp.dll from C:\Debuggers, suggesting DLL sideloading on Windows.

Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths

Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.

Windows: Alert on wget.exe downloading files from an IP with output flags

Flags Windows wget.exe usage to download HTTP URLs from IPs and write outputs to script/binary extensions.

Windows: curl.exe Local File Read via file:/// Command Line

Flags curl.exe runs that include file:/// to access local files on Windows.

Windows: Curl.exe Insecure Proxy/DOH Transfer Flags

Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.

Suspicious curl.exe File Downloads From Direct IP Addresses on Windows

Alerts on Windows curl.exe commands downloading from an IP address with HTTP/S and suspect file extensions.