Sigma detection rules, expert-reviewed

Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File

Alerts when schtasks.exe creates a scheduled task using -XML but the referenced file does not end with .xml.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows mstsc.exe launched with a local .rdp file from suspicious paths

Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.

Windows mstsc.exe launched with local .rdp file argument

Alerts on mstsc.exe executions that reference local .rdp files via the command line.

Windows: Uncommon Process Creates .rdp Remote Desktop File

Alerts on creation of .rdp files by processes that are not typically associated with producing them on Windows.

Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer

Alerts on winget staging under Temp\WinGet combined with ZoneTransfer ZoneId=3 and Zone.Identifier ADS contents.

Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1

Flags setting the Winget AppInstaller local manifest installation policy (EnableLocalManifestFiles) to enabled.

Windows winget AppInstaller admin_settings registry modification via winget.exe

Detects winget.exe-driven changes to AppInstaller admin_settings in the registry under LocalState\admin_settings.

Windows Process: winget adds new download source via 'source add' with IP/endpoint

Alerts on winget.exe being used to add a new package download source specified by an IP address.

Windows Winget adds HTTP package source

Alerts when winget is used to add a package source pointing to an http:// URL.

Windows: winget.exe adds new download sources via 'source add'

Alerts on winget.exe usage to add new package download sources using 'source add'.

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.

Windows: Stracciatella.exe Process Execution Identification (SharpPick behavior)

Alerts on Windows process creation for Stracciatella.exe using PE metadata and known SHA256 hashes.

Windows Process Creation: Certipy Tool Execution Based on PE and CLI Parameters

Flags Certipy.exe execution on Windows using PE metadata and Certipy-like AD CS command-line arguments.

Windows HackTool Certify Execution via Certify.exe and common AD abuse arguments

Identifies Windows processes running Certify.exe with AD certificate abuse-oriented command line arguments.