Sigma detection rules, expert-reviewed

Sysmon FileBlockExecutable event: blocked executable execution attempts on Windows

Alerts when Sysmon blocks an attempted executable execution due to FileBlockExecutable policy violations.

PowerShell Write-EventLog with -RawData Flag

Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.

Windows Process Creation: mshtml.dll RunHTMLApplication Execution via Protocol Handlers

Alerts on Windows command lines invoking mshtml.dll RunHTMLApplication (via #135) with path traversal markers.

Windows Firewall rule deleted via netsh.exe command line

Flags netsh.exe executions that contain Windows Firewall rule deletion commands.

Windows DLL Sideloading: System DLL Names Loaded from Non-Standard Paths (ImageLoad)

Alerts when Windows image loads DLL names typically found in system locations, excluding common benign paths to reduce false positives.

Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load

Flags rundll32.exe loading a renamed comsvcs.dll module consistent with process memory dumping behavior on Windows.

Windows Shell-Core: Installed Application Shortcut Indicators for Known Tools

Flags suspicious installation-style activity in Windows shell-core based on EventID 28115 app resolver cache entries for specific tools.

Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path

Identifies ESENT EventID 325 where a new database containing ntds.dit is created in suspicious locations.

Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit

Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.

Windows: Unusual Process Tree for wab.exe and wabmig.exe

Alert on abnormal parent/child process relationships involving wab.exe and wabmig.exe in Windows process creation logs.

Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths

Alerts when wab.exe or wabmig.exe run from unexpected directories on Windows.

Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember

Flags Windows command lines that add a user to the local administrators group via net.exe or Add-LocalGroupMember.

Windows: findstr.exe LSASS keyword matching for process reconnaissance

Alert on find.exe/findstr.exe command lines containing "lsass", indicating potential LSASS-focused reconnaissance.

Windows file write events where executables save files with suspicious script/binary extensions

Alerts when common Windows system executables write files ending in suspicious extensions like .ps1, .bat, .vbs, or .hta.

Windows Malicious iphlpapi.dll Dropped in OneDrive/Teams AppData Directory

Flags creation of iphlpapi.dll in the Microsoft AppData area used by OneDrive/Teams, consistent with DLL sideloading attempts.