Every published rule

Windows Registry Change Disabling WinDefend Service (WinDefend Start=4)

Flags registry changes that set WinDefend service Start to 0x4, indicating potential defensive impairment.

Windows Registry AutoLogger Session Disable/Start Tampering via Event Log Targets

Alerts when registry changes disable or stop AutoLogger sessions for EventLog-* or Defender by setting Enabled/Start to 0x0.

Windows sc.exe Service StartupType Change to Disabled or Demand

Flags sc.exe commands that change a Windows service startup type to disabled or demand.

Windows reg.exe importing .reg files from common user and temp directories

Flags reg.exe importing .reg files when the command line references user or temp directories.

Windows reg.exe deletes service registry keys using the delete flag

Alerts on reg.exe command lines that delete entries under the Windows services registry path.

Windows query.exe used to enumerate sessions and processes (possible data exfil staging)

Detects query.exe runs that request session and process output, matching patterns consistent with staged data collection.

Windows Defender mpclient.dll Side-loading: MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Alerts when MpCmdRun.exe or NisSrv.exe runs from non-default directories, a common indicator of possible mpclient.dll sideloading.

Windows dnscmd.exe DNS Zone and Record Enumeration Command Execution

Flags dnscmd.exe executions that enumerate DNS zones/records via process creation command-line parameters.

Windows ISO File Creation in User Temp and Outlook Cache Folders

Alerts on creation of .iso files in Windows AppData temp or Outlook cache paths.

Windows DLL Search Order Hijack via Space in System Directory Paths

Alerts on .dll events targeting Windows system paths with an extra space, indicative of DLL search order hijacking.

Windows Sysmon Driver Altitude Registry Changes

Identifies registry writes that change the Sysmon instance altitude value, which can disrupt Sysmon loading at boot.

Windows schtasks Scheduled Task Create/Modify Running as SYSTEM

Alerts on Windows schtasks task create/modify commands that set the run account to NT AUTHORITY\SYSTEM.

Windows: Suspicious Scheduled Task Modification via schtasks /Change /TN

Flags schtasks.exe executions that modify existing scheduled tasks (/Change /TN) using suspicious locations and command-line payload tooling.

Windows File Creation: Suspicious DLL/EXE/SYS in Spool Drivers Color Folder

Alerts on creation of .dll, .exe, or .sys files under C:\Windows\System32\spool\drivers\color.

Windows Registry: Appx DebugPath Key for Potential Persistence

Detects registry set activity involving AppX DebugPath entries that may indicate persistence via packaged app debug configuration.

Windows Browser Launched with Remote Debugging Flags

Alerts on Windows launches of Chromium-based browsers or Firefox with remote debugging command-line flags.

Windows: WinRing0 Driver Load via Image Hash and File Name Match

Alerts on Windows driver loads matching WinRing0 modules by IMPhash or expected WinRing0 filenames.

Windows: Detect SelectMyParent PPID Spoofing Tool Execution

Flags SelectMyParent.exe process creation with PPID spoofing command-line and metadata indicators on Windows.

Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators

Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.

Windows Service Installation: PDQDeployRunner Remote Service Creation (Service Control Manager)

Flags new Windows services installed with PDQDeployRunner-* naming via Service Control Manager event 7045.