Sigma detection rules, expert-reviewed

Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.

Windows: Odbcconf.exe used to register a DLL via REGSVR

Flags odbcconf.exe executions using REGSVR to register a DLL, a regsvr32-equivalent technique often abused by attackers.

Windows Process Execution: odbcconf.exe with DLL in Suspicious Path

Flags odbcconf.exe process launches when the command line references DLL-related paths in suspicious Windows locations.

Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line

Alerts when odbcconf.exe is run with INSTALLDRIVER and a .dll, indicating potential malicious ODBC driver DLL installation.

Windows Suspicious Non-Browser Network Traffic to api.telegram.org

Alerts on Windows network connections to api.telegram.org by processes other than common web browsers.

Windows Security Event 4661 Password Policy Enumeration via ReadPasswordParameters

Flags Windows Event 4661 activity indicating password policy enumeration (ReadPasswordParameters on Security Account Manager).

Windows WerFault ReflectDebugger Registry Key Value Targeting

Flags registry set events targeting WerFault ReflectDebugger under Windows Error Reporting Hangs for potential persistence abuse.

PowerShell Certificate Export Cmdlets in Windows Process Creation

Flags PowerShell command lines invoking certificate export cmdlets (Export-PfxCertificate/Export-Certificate) on Windows.

Windows WWlib.DLL sideloading via Office process loading behavior

Alert on Windows image-load events where winword-associated processes load wwlib.dll outside expected Office paths.

Windows CreateStreamHash: Suspicious Embedded File Download Indicators via .zip TLD

Flags Windows downloads indicating .zip/ plus ':Zone' in target filenames for risky executable or script extensions.

Windows: Rundll32 Executions Using Obfuscated Ordinal Call Arguments

Flags rundll32.exe launches with command-line ordinal obfuscation patterns.

Windows: Suspicious rundll32 Execution of advpack.dll with Ordinal RegisterOCX Calls

Identifies rundll32.exe launching advpack.dll with ordinal-style calls consistent with stealthy OCX registration behavior.

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Alerts on Windows processes running cloudflared tunnels with config and token/credential flags.

Windows: Detect cloudflared tunnel cleanup command execution

Flags Windows executions of cloudflared with tunnel cleanup and connector/config parameters.

Windows Registry: Internet Explorer DisableFirstRunCustomize Set via Explorer or ie4uinit

Alerts on Windows registry writes to Internet Explorer DisableFirstRunCustomize that change first-run wizard customization states.