Sigma detection rules, expert-reviewed

Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.

Windows Registry Add WFP Filter Rules via BFE Parameters Path

Alerts on registry changes adding persistent WFP filters under the BFE policy persistent filter path via svchost.exe.

Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

Windows process creation: child process spawned by winrshost.exe

Flags Windows process children of winrshost.exe that may indicate WinRS-driven remote command execution.

Windows Winrs.exe Local Command Execution via localhost/loopback

Alerts on Winrs.exe processes running locally by targeting localhost/loopback in /r or /remote.

Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes

Alerts on .jsp writes into Apache/Tomcat webapps ROOT from dotnet/java/IIS worker processes on Windows.

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

Windows SMB Server Share Connection Without Signing or Encryption

Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.

Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming

Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.

Windows Process Execution: Restic Backup Tool Command-Line Indicators

Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.

WSL Process Execution of Kali Linux on Windows

Flags Kali Linux running under WSL on Windows using process creation image and command-line indicators.

Windows WSL Kali Linux installation via wsl.exe --install -i

Flags wsl.exe commands that install a distribution specified as Kali Linux using --install -i.

Windows Registry RunMRU Key Deletion

Alerts on deletion of the Windows Run dialog command history (RunMRU) registry key.