Sigma detection rules, expert-reviewed

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

Windows DLL image load: credui.dll loaded by an uncommon process

Detects credui.dll or wincredui.dll being loaded by a process other than common system binaries.

Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)

Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.

Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)

Alerts on VSSAudit security event source registration in Windows Security logs using Event IDs 4904/4905.

Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r

Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.

Windows Process Execution and DLL Injection via Tracker.exe

Alerts on Tracker.exe executions with /d and /c command-line switches, excluding matching MSBuild child process patterns.

Windows: msdeploy.exe Execution with sync and RunCommand Parameters

Flags msdeploy.exe executions that include sync verb plus RunCommand source and destination parameters.

Windows PowerShell Process Creation: COMPRESS OBFUSCATION with ASCII Encoding and DeflateStream

Flags PowerShell process creation command lines that use ASCII encoding plus compression/stream-reading patterns associated with obfuscation.

Windows: Dotnet.exe executes arbitrary DLL or csproj files

Alerts when dotnet.exe runs with .csproj or .dll arguments that may indicate loading or execution of untrusted .NET code.

PowerShell ScriptBlock Logging: Obfuscated RUNDLL Launcher using rundll32.exe and shell32.dll

Identifies PowerShell script content invoking rundll32.exe/shell32.dll via shellexec_rundll and referencing PowerShell.

Detect PowerShell COMPRESS OBFUSCATION using ASCII text encoding and stream/compression APIs

Flags PowerShell script blocks that combine ASCII encoding with Deflate/stream handling indicative of obfuscated payload compression.

PowerShell module activity launching rundll32 via shell32.dll obfuscation content

Alerts when PowerShell module payloads reference a shell32/rundll32 launcher pattern that includes PowerShell.

PowerShell Module Payload Obfuscation Using COMPRESS OBFUSCATION

Identifies PowerShell module payloads containing ASCII encoding and compression/stream obfuscation strings.

Windows System: Detect rundll32 Service Control Manager launches PowerShell via obfuscated parameters

Flags service creation where ImagePath uses rundll32/shell32 (shellexec_rundll) to invoke PowerShell.

Windows System: Service Control Manager PowerShell Obfuscation Using COMPRESS OBFUSCATION

Flags new Windows services whose ImagePath includes obfuscated PowerShell markers using COMPRESS/stream decompression.