Sigma detection rules, expert-reviewed

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Suspicious File Creation by OpenEDR ITSMService on Windows

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.

Windows Process Creation: node.exe Running npx skills add New Agent Skills

Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.

Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting

Flags registry changes that disable Windows Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0).

Windows Vulnerable Driver Blocklist Registry Tampering via PowerShell or REG.EXE

Flags PowerShell/REG.EXE command lines that change the VulnerableDriverBlocklistEnable registry setting under \Control\CI\Config.

Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

Windows Registry: Alert on Changes to \shell\open\command Targeting Common Malware Paths

Alerts on registry_set events modifying \shell\open\command to point to suspicious temp/user-writable locations.

Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection

Alerts on MSDTC MTxOCI registry changes to OracleOciLib/OracleOciLibPath that may redirect oci.dll loading to attacker-controlled locations.

Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)

Alerts on cmd.exe invoking start.exe with /b or /min, especially when directed at scripts or files in suspicious temp/public paths.

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

Windows: Kernel Driver Utility (KDU) and hamakaze.exe Execution

Alerts on KDU/hamakaze.exe launches with command-line parameters associated with kernel driver loading.