Sigma detection rules, expert-reviewed

PowerShell Local User Creation via New-LocalUser

Flags PowerShell usage of New-LocalUser, indicating creation of a Windows local user.

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties

Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

PowerShell Downgrade Attempts via -Version 2 on Windows Process Creation

Alerts on PowerShell executions specifying a -Version 2 argument, consistent with potential downgrade attempts.

Windows Desktop.ini Accessed by Uncommon Process

Alerts when unexpected processes create or access Desktop.ini, which can be abused to change how Explorer displays folder contents.

Windows Process Execution of .SettingContent-ms Command Line

Flags Windows processes whose command lines reference .SettingContent-ms, a potential trigger for setting-based execution.

Windows: Alert on Uncommon Child Process Executed from Appvlp.exe

Alerts on unusual child processes created by Appvlp.EXE on Windows, indicating potential command execution abuse.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

Windows Registry: TrustRecords key modification indicating macro-based initial access

Flags Windows registry writes to Security\Trusted Documents\TrustRecords, a signal consistent with macro-enabled initial access.

Windows: Office Application Loads VBE VBA DLLs via Image Load Events

Flags Office apps loading VBA-related VBE DLLs, a strong indicator of VBA macro execution.

Windows Office Apps Loading .NET GAC MSIL DLLs via Image Load Events

Alerts when an Office app loads a .NET DLL from the GAC_MSIL directory.