Sigma detection rules, expert-reviewed

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.

Windows Process Creation: Impersonate.exe HackTool Execution

Flags execution of impersonate.exe (Impersonate tool) on Windows using command-line subcommands or known hashes.

Windows Registry Set Detection of Suspicious Environment Variable Commands

Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.

Windows Office Binary Execution with Renamed Image Path

Alerts when Office apps are executed under renamed or unexpected image paths, helping catch stealthy masquerading on Windows.

Windows SQLite CLI Querying Chromium Browser Profile Databases

Alerts when SQLite CLI is used to query Chromium-based browser profile databases containing logins, cookies, or history.

Windows DLL Sideloading via comctl32.dll in .local directories

Alerts on comctl32.dll loaded from System32 .local folders, consistent with Windows DLL sideloading.

Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32

Detects System32 *.exe.local entries that reference comctl32.dll, consistent with DLL sideloading behavior.

Windows DLL Sideloading Indicator: JsSchHlp Loads JSESPR.dll from Untrusted Path

Alerts on unexpected loads of \JSESPR.dll, indicating possible DLL sideloading outside the Justsystem JsSchHlp directory.

Windows DLL Sideloading: ClassicExplorer32.dll Loaded from Unexpected Path

Alerts when ClassicExplorer32.dll is loaded from unexpected locations, suggesting possible DLL sideloading behavior.

Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text

Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Identifies uncommon setres.exe children matching '\choice' while excluding System32/SysWOW64 choice.exe.

Windows: Detect rcedit editing PE version/resource metadata via --set-*

Alerts on rcedit command-line usage that sets PE metadata fields to alter executable file properties.

Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe

Alerts on mklink creating a symlink between osk.exe and cmd.exe, enabling potential login-screen privilege escalation.