Sigma detection rules, expert-reviewed

Windows: Mounting Internet Hosted WebDAV Shares via net.exe

Alerts on net.exe (net1.exe) commands that mount an HTTP/WebDAV network share.

Windows New Service Creation via sc.exe

Flags sc.exe service creation commands containing create and binPath on Windows, excluding Dropbox-launched cases.

PowerShell Creates Windows Service via New-Service and -BinaryPathName

Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.

Windows Registry Persistence Indicators in Event Viewer Events.asp Links

Flags Windows registry entries that reference Event Viewer Events.asp redirection URLs, excluding known benign svchost/GPO templates.

Windows suspicious vsstrace.dll image load by uncommon executables

Alert on vsstrace.dll module loads from processes outside common Windows/system paths.

Windows Tomcat Log File Deletion Indicating Possible Forensic Evidence Destruction

Flags Windows file deletions matching Tomcat log paths and common Catalina/localhost access log filename patterns.

Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)

Alerts on Windows process launches with command lines containing Unicode U+202E to support right-to-left text obfuscation.

Windows: certutil.exe ExportPFX certificate export via -exportPFX flag

Flags certutil.exe executions on Windows that include the -exportPFX argument to export certificate material.

Windows: certutil.EXE Downloading Files from File-Sharing Domains via Suspicious Flags

Alert when certutil.exe is run with URL/download flags targeting common file-sharing domains.

Windows certutil.exe Download from Direct IP Using URL/IP-Related Flags

Alerts when certutil.exe is launched with direct-IP download indicators and download-capable certutil flags.

Windows certutil.exe Used to Download Files via Suspicious Command-Line Flags

Alerts on certutil.exe runs with URL/HTTP-related flags indicative of remote file download.

Windows certutil.exe Base64/Hex Decode via -decode or -decodehex Flags

Flags certutil.exe use for decoding base64 or hex data via -decode or -decodehex on Windows.

Windows: CertOC.exe Loading a DLL from User-Writable Paths via -LoadDLL

Alerts on CertOC.exe using -LoadDLL with DLLs from temp/user-writable directories on Windows.

Windows PowerShell Console History File Deleted (PSReadLine)

Flags deletion of the PowerShell PSReadLine ConsoleHost_history.txt file, which can remove command history evidence.

Windows Event Log EVTX File Deletion in winevt\Logs

Flags deletion of Windows Event Log .evtx files under System32\winevt\Logs.