Sigma detection rules, expert-reviewed

PowerShell Executed From AppData on Windows (Command Line Indicators)

Flags PowerShell command lines that include AppData paths (Local/Roaming), indicating possible user-profile script execution.

Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled

Flags Windows process command lines that reference Outlook’s EnableUnsafeClientMailRules security setting.

Windows Process Creation: SecurityXploded PasswordDump.exe Execution

Alerts on Windows executions of SecurityXploded PasswordDump.exe based on process metadata and filename.

Windows Process Creation: Rubeus HackTool Execution Indicators

Flags Windows process executions of Rubeus.exe when command lines include Kerberos attack-related actions.

Windows Process Creation: Command Line Obfuscation via Escape Characters

Identifies Windows process command lines containing escape-character URL obfuscation patterns.

Windows Remote Thread Injection Indicators via Process StartAddress Suffixes

Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.

Windows: Suspicious Executable Downloads Missing File Metadata Fields

Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).

Windows PowerShell Base64-encoded shellcode in ScriptBlockText

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

Windows: Potential Kerberoasting SPN Enumeration via setspn.exe

Detects Windows setspn.exe runs with SPN query command-line parameters that may indicate Kerberoasting preparation.

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.

Windows: Local user account creation via net.exe or net1.exe

Alerts on net.exe/net1.exe launching with "user" and "add" to create local accounts on Windows.

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Flags PowerShell (powershell.exe/pwsh) process executions with command-line indicators consistent with XOR/obfuscated scripting.

Windows PowerShell Suspicious Encoded Command-Line Execution

Alerts on PowerShell launched with encoded-command switches and embedded encoded content patterns in the command line.

Windows Process in Suspicious Folder Initiating Network Connections to File Sharing Domains

Alerts on outbound connections to file sharing domains from Windows executables running out of suspicious temp/recycle/task paths.

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.