Sigma detection rules, expert-reviewed

Windows Registry: mpnotify SIP Provider Persistence via Winlogon

Detects registry writes to the Winlogon mpnotify location indicating potential SIP-provider persistence.

Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)

Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.

Windows Registry: New IFilter Registration via PersistentHandler/CLSID Keys

Flags registry writes that register new Windows Search IFilters/persistent handlers via PersistentHandler and CLSID key patterns.

Windows Registry Persistence via HtmlHelp Author Location Modification

Detects Windows registry updates to HtmlHelp Author Location paths that may be used for persistence.

Windows Registry AMSI Provider Persistence via Providers Key

Alerts on registry activity creating/modifying AMSI provider entries under the Microsoft AMSI Providers keys.

Windows Registry Persistence via hhctrl CLSID InprocServer32 Default Modification

Flags registry changes to the hhctrl COM CLSID InprocServer32 (Default) to load a custom binary instead of the system hhctrl.ocx.

Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key

Flags registry modifications adding a Debugger entry under Windows Error Reporting Hangs, a potential crash-triggered persistence technique.

Windows Registry Persistence via Disk Cleanup Handler Autorun Keys

Flags registry changes under Windows Disk Cleanup Handler VolumeCaches that set Autorun and command-like handler values.

Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence

Flags registry writes that set an AeDebug Debugger .dll value, enabling debugger execution on application crashes.

Windows Registry Disk Cleanup Handler Persistence via VolumeCaches Key Creation

Detects creation of non-default Disk Cleanup Handler registry entries under VolumeCaches that may establish persistence.

Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM

Alerts when PSEXESVC spawns a child process running as LOCAL SYSTEM (AUTHORI/AUTORI) on the local host.

Windows PsExec Service Binary Renamed Execution via psexesvc.exe

Alerts when psexesvc.exe is executed from a non-standard path, suggesting renamed or relocated PsExec service usage.

Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut

Alert on explorer.exe writing Startup-folder LNK files whose names include {0AFACED1-E828-11D1-9187-B532F1E9575D}, indicating shortcut-based persistence.

Windows UEFI Persistence: Detect wpbbin.exe Execution

Alerts on execution of C:\Windows\System32\wpbbin.exe, a potential indicator of UEFI persistence on Windows.

Windows UEFI Persistence Indicator: Creation of C:\Windows\System32\wpbbin.exe

Flags creation of C:\Windows\System32\wpbbin.exe, a potential UEFI persistence artifact.