Sigma detection rules, expert-reviewed

Windows Security Event 4719 Audit Policy Changes indicate Windows auditing disabled

Flags Windows Event Auditing disabled indicators from Security Event ID 4719 with removed success/failure audit policy.

Windows File Events: java.exe in AppData\Roaming\Oracle\bin Path with .exe and .vbs Artifacts

Alerts on Windows file events for suspicious java*.exe placement in AppData\Roaming\Oracle\bin and .vbs files containing "Retrive".

Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)

Flags USB device plug/unplug related Driver Frameworks User-Mode events using Windows event IDs 2003, 2100, and 2102.

Windows Named Pipe Creation Alert for Known Malicious Pipe Names

Alert on Windows named pipe creations where the PipeName matches known malware-associated pipe identifiers.

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

Windows Registry Key Created: Sysinternals EULA Acceptance

Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.

Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.

Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.

Windows svchost.exe Spawned by Uncommon Parent Process

Alerts when svchost.exe starts with an unusual parent process name on Windows.

Windows Security: Account Encryption/Preauth/Delegation Flags Weakened in User Account Changes

Flags Windows Event ID 4738 user account changes that enable weaker encryption or related pre-auth behavior.

Windows Security: SeEnableDelegationPrivilege Enabled via AD User Right (Event 4704)

Alerts when Event ID 4704 assigns SeEnableDelegationPrivilege, enabling control over other AD user objects.

Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Alerts on Windows security file access events for object names ending in .AAA or .ZZZ, consistent with secure deletion behavior.

Windows WCE wceaux.dll File Access via Security Event 4656/4663

Identifies Windows Security event activity involving access to the wceaux.dll library file.

Windows PsExec Service Execution via PSEXESVC.exe

Detects PsExec service execution by matching the PSEXESVC.exe process on Windows.