Sigma detection rules, expert-reviewed

Windows: Pubprn.vbs Script Proxy Execution via script: Command Line

Flags command-line executions referencing Pubprn.vbs with 'script:' indicative of proxy script command execution on Windows.

Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

Alerts when PowerShell command lines contain encoded obfuscation patterns referencing Net.Webclient with anomalous casing.

Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.

Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable

Detects chained cmd/.bat staging that uses xcopy plus PowerShell/pwsh and attrib +h/+s to run a .bat.exe payload associated with Jlaive.

Windows: rundll32.exe launched by explorer.exe parent process

Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.

Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1

Alerts on PowerShell being launched with CL_mutexverifiers that proxies additional script execution.

PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions

Alerts on PowerShell command lines that call LoadAssemblyFromPath/LoadAssemblyFromNS in CL_LoadAssembly.ps1 context.

Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Binaries Downloading Files via HTTP(S) Potentially Arbitrary Payload

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

Alerts on Windows process creation for ttdinject.exe (TTDInject.EXE), a time travel debugging component.

Windows gpscript.exe Executes Group Policy Logon/Startup Scripts

Flags gpscript.exe running with /logon or /startup, suggestive of Group Policy script execution abuse.

Windows IEExec.EXE Download-and-Execute via Process Creation

Flags IEExec.exe executions that reference HTTP/HTTPS URLs for download-and-execute behavior.