Sigma detection rules, expert-reviewed

Windows MSSQL xp_cmdshell Setting Change (EventID 15457)

Flags MSSQL xp_cmdshell setting changes using Windows application EventID 15457 events containing 'xp_cmdshell'.

Windows MSSQL xp_cmdshell Command Execution via Application Event 33205

Alerts when SQL Server xp_cmdshell is invoked to execute commands, using Windows application EventID 33205 data.

Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns

Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.

Windows DNS Queries to Remote Support and Remote Access Domains From Non-Browser Processes

Alert on DNS lookups for remote access service domains from non-browser executables, including RustDesk subdomains.

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

Windows: Detect Named Pipe Creation with Koh Default Names

Alerts on Windows named pipe creation with Koh default identifiers in the pipe name.

Windows PowerShell: Import-Module From Temp, AppData, or Public Directories

Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.

Windows Registry Changes Disabling Windows Defender Event Log Channel

Detects registry changes that disable the Windows Defender Operational event log channel by setting its Enabled DWORD to 0.

Windows Registry Event Log Tampering by Disabling WINEVT Channel Enabled Key

Flags registry changes that set WINEVT channel Enabled to 0x00000000 to disable Windows event logging.

Windows UAC Bypass via IDiagnosticProfileUAC Triggered from DllHost.exe

Flags elevated process creation where DllHost.exe launches using the specific IDiagnosticProfileUAC /Processid value.

Windows: DllHost.exe creates a System32 DLL for UAC bypass via IDiagnosticProfileUAC

Alerts when dllhost.exe creates a System32 .dll consistent with IDiagnosticProfileUAC UAC bypass behavior.

Windows: Execution of .xbap via PresentationHost.exe from Uncommon Paths

Alerts when PresentationHost.exe launches a .xbap file from a non-standard location on Windows.

Windows: Execution of ScriptRunner.exe with appvscript Argument

Flags ScriptRunner.exe executions that include the " -appvscript " parameter in the command line.

Windows: Suspicious LSASS handle access via svchost.exe call trace to seclogon.dll

Flags svchost.exe attempting LSASS access (granted access 0x14c0) with seclogon.dll in the call trace.

Windows: assoc.exe Changes File Extension Handler to exefile

Alerts on cmd.exe running assoc to set file extension handlers to exefile, indicating possible persistence via file associations.