Sigma detection rules, expert-reviewed

Windows LiveKD Driver File Creation by Uncommon Process Image

Alerts when LiveKdD.SYS is created by a process other than livekd.exe/livek64.exe on Windows.

Windows LiveKD Driver Creation via LiveKdD.SYS and LiveKD Executable Launch

Detects creation of LiveKdD.SYS in the Windows drivers directory by LiveKD executables.

Windows: LiveKD kernel memory dump file creation (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Flags wscript.exe/cscript.exe launching files named with uncommon non-script extensions via command-line content.

Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)

Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.

Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping

Detects launching LiveKD (livekd.exe/livekd64.exe) on Windows via image path or PE OriginalFileName metadata.

Windows Process Creation of Kernel Debugger kd.exe

Flags Windows process creations that run kd.exe using image path and OriginalFileName metadata.

Suspicious Child Process of GoogleUpdate.exe on Windows

Alerts when GoogleUpdate.exe spawns an unexpected child process on Windows, using parent/child image telemetry and allowlisting common Google updaters.

Windows Process Creation: certutil.exe Encodes Files to Base64 in Suspicious Paths

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows DLL Sideloading: goopdate.dll Loaded from Nonstandard Paths

Alerts when goopdate.dll is loaded from non-standard locations, suggesting possible DLL sideloading behavior on Windows.

Windows RoboForm DLL Sideloading via ImageLoaded roboform.dll/roboform-x64.dll

Alerts on loaded roboform*.dll modules on Windows when module loading is not matched to expected RoboForm binaries.

Windows Certificate Export from Local Certificate Store (Event ID 1007)

Flags Windows events where a certificate is exported from the local certificate store via Certificate Services client telemetry.

Windows CAPI2 Event 70: Certificate Private Key Acquired

Detects when Windows CAPI2 logs that a process acquired a certificate private key (EventID 70).

Windows Excel Loads .XLL Add-in from Uncommon File Paths

Flags Excel loading .xll add-ins from uncommon directories based on image load paths.