Sigma detection rules, expert-reviewed

Windows DHCP Server Loaded Callout DLL via Registry

Flags DHCP Server events where a registry-specified callout DLL is loaded (Event ID 1033), indicating potential persistence or execution.

Windows Backup Catalog Deleted (Microsoft-Windows-Backup Event ID 524)

Alerts when Windows deletes the backup catalog via Microsoft-Windows-Backup Event ID 524.

Windows Error Reporting: MsMpEng.exe Crash with mpengine.dll

Alerts on WER EventID 1001 crashes where MsMpEng.exe and mpengine.dll appear in the event data.

Windows Application Error: MsMpEng.exe Crash Involving mpengine.dll

Alerts on Windows Application Error EventID 1000 indicating a crash involving MsMpEng.exe and mpengine.dll.

Windows DNS ServerLevelPluginDll Registry Installation

Detects registry changes setting DNS ServerLevelPluginDll, which can enable malicious DNS plugin DLL loading after restart.

Windows: Detect dnscmd.exe setting ServerLevelPluginDll to install DNS plugin DLL

Flags dnscmd.exe DNS configuration that sets ServerLevelPluginDll, indicating potential malicious DNS server code injection.

Windows DNS Server error when loading ServerLevelPlugin DLL fails

Flags Windows DNS Server errors where the ServerLevelPluginDLL plugin DLL fails to load.

Windows Rundll32 DLL Load via control.exe spawning

Alerts on control.exe spawning rundll32.exe to load Shell32.dll via DLL invocation patterns.

Windows Security: AD user/computer backdoor via msDS-AllowedToDelegateTo and delegation attributes

Alerts on AD delegation-related attribute changes that may create credentialless account control paths.

PowerShell Credential Prompt via PromptForCredential

Flags PowerShell scripts that reference "PromptForCredential", indicating credential prompt behavior in Script Block Logging.

PowerShell downgrade indicators via EngineVersion=2. and HostVersion !=2. (Windows)

Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.

Windows Registry UAC Bypass via Event Viewer Command Key (mscfile shell open command)

Alerts on registry changes to the mscfile shell open command key consistent with an Event Viewer UAC bypass technique.

Windows Event Viewer (eventvwr.exe) Spawns Suspicious Child Processes

Alerts when eventvwr.exe spawns unusual child processes in Windows process creation logs.

Windows Network Connections to Uncommon Ports (8080, 8888)

Flags Windows-initiated connections to ports 8080/8888 excluding private/local IPs and Program Files binaries.

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Flags Windows processes initiating outbound connections to malware callback ports, excluding local/private IP ranges.