Sigma detection rules, expert-reviewed

Windows Registry Deletion of Shell Open Command COM Hijacking Key Paths

Flags registry deletions of \shell\open\command paths that may indicate removal of COM hijacking execution entries.

Windows sdclt.exe Spawned with High Integrity (Possible UAC Bypass)

Alerts on sdclt.exe launching as High integrity, indicating possible elevated execution consistent with UAC bypass attempts.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.

Windows sdclt.exe Child Process Creation

Alerts when sdclt.exe launches a child process, a behavior consistent with abused Windows binaries in escalation chains.

Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)

Flags svchost.exe spawning rundll32.exe to run davclnt.dll,DavSetCookie, consistent with WebDAV client execution.

PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows

Flags Windows command lines containing Get-Clipboard, indicating potential clipboard data collection via PowerShell.

Windows PowerShell Get-Clipboard Command Execution

Flags PowerShell activity that includes the Get-Clipboard command, which may be used to collect clipboard contents.

PowerShell Decompress via Expand-Archive

Alerts on PowerShell usage of Expand-Archive, a common decompression step attackers may use to unpack files.

Windows Startup Directory File Writes for Persistence

Alerts on file writes into the Windows Startup folder that may indicate user-level persistence.

Windows File Deletion Using Sysinternals SDelete (SDelete rename suffixes)

Flags Windows file deletions targeting filenames ending in .AAA or .ZZZ consistent with SDelete-style artifact removal.

Windows findstr Launches .lnk via Command Line

Flags find.exe or findstr.exe processes whose command lines end with a .lnk file.

Windows winget Installs Applications Using Local Manifest File

Flags winget.exe install commands that specify a local manifest file via -m/--manifest.

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Flags Windows command lines that create or copy files into C:\Windows\Fonts\ using suspicious file extensions.

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Detects netsh.exe command-line activity targeting WLAN and clearing keys, indicative of potential WiFi credential harvesting on Windows.

Windows: Process Execution of Suspicious hxtsr.exe (Outside WindowsApps)

Alerts when hxtsr.exe runs from a non-expected WindowsApps Microsoft.WindowsCommunicationsApps location.