Sigma detection rules, expert-reviewed

Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc

Detects rundll32.exe launching davclnt.dll DavSetCookie with HTTP and spoolss/srvsvc pipe parameters associated with NTLM coercion.

Windows Registry: Service configured with image path in suspicious public/temp folders

Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.

Windows: PrintBrm.exe ZIP extraction or creation via command-line parameters

Flags PrintBrm.exe executions that include '-f' and '.zip', consistent with ZIP creation or extraction behavior.

Windows JScript Compiler (jsc.exe) Process Execution

Identifies execution of jsc.exe (JScript Compiler) from Windows process creation logs.

Windows Process Creation: gpresult.exe Group Policy (RSoP) Discovery (/z /v)

Flags process executions of gpresult.exe that request RSoP details using /z and /v on Windows.

Windows svchost.exe RDP (3389) Connections to HTTP/HTTPS Ports 80 or 443

Alerts when svchost.exe initiates from TCP 3389 to destination ports 80 or 443, consistent with possible RDP tunneling over web ports.

Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs

Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.

Windows rundll32.exe executing InstallScreenSaver via desk.cpl SCR File

Detects rundll32.exe launches with InstallScreenSaver behavior via desk.cpl, a screensaver execution technique.

Windows Microsoft Sync Center (mobsync.exe) Network Connections to Public IPs

Alerts when mobsync.exe makes outbound connections to destination IPs outside private/local ranges.

Windows: Copying Executable or DLL Files into Default GPO Policies Folder

Alerts when .exe/.dll files are created in the default GPO storage folder path.

Windows: Files created by Microsoft Sync Center (mobsync.exe) with .dll/.exe extensions

Flags .dll and .exe files created by mobsync.exe on Windows.

Windows: rundll32.exe spawning explorer.exe child process (shell32.Control_RunDLL)

Alerts on rundll32.exe spawning explorer.exe, an uncommon child process pattern that may indicate stealthy execution via shell components.

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Flags Windows process creation for KrbRelay.exe with Kerberos relaying-related command-line arguments.

Windows Hacktool Execution via PE Metadata Company Field

Flags execution of Windows binaries with PE Company metadata set to "Cube0x0", even when renamed.

Windows UAC Bypass via Event Viewer RecentViews File Creation

Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.