Sigma detection rules, expert-reviewed

Windows: PowerShell Core DLL Loaded by Office Application

Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process

Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

Windows regsvr32 Execution from Suspicious DLL Paths

Alerts on regsvr32 runs whose command line references a DLL in highly suspicious Windows directories.

Windows regsvr32 Execution with DLL Path in Common Temporary/Public Directories

Alert on regsvr32.exe runs whose command line points to DLLs in Temp/Public-style directories.

Suspicious Windows regsvr32 Command-Line Uses FTP/HTTP to Register Remote Components

Alerts on regsvr32 command lines using /i flags with ftp/http content, consistent with remote DLL registration.

Windows DNS Server: Failed DNS Zone Transfer Requests (Event ID 6004)

Alerts on Windows DNS Server Event ID 6004 indicating a failed DNS zone transfer request for a non-existent or non-authoritative zone.

Windows Registry: New ODBC Driver Registration in Suspicious Path

Alerts when Windows registers a new ODBC driver under the ODBCINST.INI area with details pointing to suspicious filesystem paths.

Windows Registry: New ODBC Driver Registration via ODBCINST.INI

Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.

Windows: Odbcconf.EXE INSTALLDRIVER Use With Missing .dll Target

Flags odbcconf.exe running INSTALLDRIVER when the driver argument lacks a .dll extension.

Windows: Uncommon Child Process Spawned by Odbcconf.EXE

Alert on unusual child processes spawned from odbcconf.exe, which may indicate indirect execution abuse.

Windows Process Execution of Odbcconf.exe with -f Response File Flag

Alerts on Odbcconf.exe being run with -f to load a response file, excluding runonce-driven executions.

Windows Odbcconf.EXE Response File Execution via -f Flag

Flags Windows executions of Odbcconf.EXE using -f to load a .rsp response file.

Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.