Sigma detection rules, expert-reviewed

Windows: Service Created by System Using Client with PID 0 (SCM Event 7045)

Alerts on Windows service installation events (SCM EventID 7045) where the client process ID is 0.

Windows Service Created by Client With PID 0 or Parent PID 0

Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.

Windows CLI Processes Using Common Weak or Abused Passwords

Alerts when Windows command lines include common weak or reused password values.

Windows PowerShell Disables Windows Firewall Profiles via Set-NetFirewallProfile

Flags PowerShell commands attempting to turn off Windows Firewall profiles using Set-NetFirewallProfile.

Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)

Alerts on ntdsutil.exe command lines that include snapshot mount and activation/instance fragments, indicating potential AD snapshot manipulation.

Windows UAC Bypass via Elevated COM interface using ICMLuaUtil

Flags dllhost.exe parent launches tied to elevated COM /Processid GUIDs consistent with UAC bypass behavior on Windows.

Windows: Taskkill used to terminate ccSvcHst.exe (Symantec Endpoint Protection service impairment)

Flags Windows taskkill /F /IM ccSvcHst.exe executions that can disable Symantec Endpoint Protection services.

Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution

Flags Windows executions of chisel.exe with client/server tunneling and SOCKS5 reverse arguments.

Windows Process Creation: 3proxy Proxy Server Execution

Detects execution of 3proxy.exe with local 127.0.0.1 proxy binding on Windows.

PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.

PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)

Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.

PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features

Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.

Windows Registry Winlogon AllowMultipleTSSessions Enabled

Alerts on enabling Winlogon AllowMultipleTSSessions (DWORD 0x00000001), allowing concurrent RDP sessions.

Windows Process Creation Recon via Event Log Query Tools and Event ID Searches

Flags Windows processes running event log query utilities and commands that search specific event IDs or dump log content.

Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types

Alerts on schtasks.exe commands that schedule tasks using ONLOGON/ONSTART/ONCE/ONIDLE with potentially malicious privilege context.