Sigma detection rules, expert-reviewed

Windows ConfigSecurityPolicy.EXE Used for HTTP/FTP Arbitrary File Transfers

Alert when ConfigSecurityPolicy.exe runs with ftp/http/https URLs in the command line, indicating potential file transfer abuse.

Windows PowerShell Clears Console History via Clear-History

Flags PowerShell attempts to clear or delete console/PSReadline command history to hinder command forensics.

Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths

Alerts on rundll32.exe loading shell32.dll with Control_RunDLL from AppData/Temp/user paths.

Windows CertReq -Post Download Attempt via HTTP

Flags certreq.exe executions using -Post -config and HTTP content retrieval indicators.

Windows bash.exe Launched with -c for Indirect Inline Command Execution

Alerts on Windows processes starting bash.exe with -c, indicating inline command execution.

Windows: aspnet_compiler.exe Execution Detection

Detects execution of aspnet_compiler.exe from Windows .NET Framework directories, which can be abused to compile and run C#.

Windows DNS Queries Triggered by DesktopAppInstaller AppInstaller.EXE

Identifies DNS lookups performed by Windows AppInstaller.EXE when initiating ms-appinstaller package installation from a URL.

Windows PsExec/PAExec Command-Line Flags Escalating to LOCAL SYSTEM

Flags in PsExec/PAExec command lines requesting LOCAL SYSTEM execution are matched via process creation command-line telemetry.

Windows Process Access: Suspicious GrantedAccess Flags Targeting lsass.exe

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.