Sigma detection rules, expert-reviewed

Windows rundll32 Locks Workstation via user32.dll LockWorkStation

Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Windows Process Creation: Renamed msdt.exe Execution

Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

Windows Process Creation: Remote.exe Execution

Alerts on execution of remote.exe on Windows, which can be abused via a WinDbg/SDK binary for stealthy remote execution.

Windows Process Execution of F# Interpreters (Fsi.exe, FsiAnyCpu.exe)

Flags execution of F# interpreter binaries fsi.exe and fsianycpu.exe on Windows.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Windows Office Startup Folder File Drop for Persistence via Office Documents

Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Windows Process Creation: wfc.exe Execution for Workflow Command-line Compiler Abuse

Alerts on execution of wfc.exe by matching process image and OriginalFileName in Windows process creation logs.

VisualUiaVerifyNative.exe Execution on Windows

Alerts when VisualUiaVerifyNative.exe is launched on Windows, a potential application-control bypass binary.

Windows Registry: Custom URL Protocol Handler Persistence via HKCR\ Protocol Registration

Alerts on HKCR registry set activity registering a new custom URL protocol handler, excluding Microsoft-style ms- protocols.

Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.