Sigma detection rules, expert-reviewed

Windows dns.exe Deletes Files with Unexpected Targets

Alerts when dns.exe deletes any file other than dns.log on Windows.

Windows: Unusual File Modification by dns.exe

Alert on dns.exe changing files other than dns.log, which can indicate suspicious or compromised system activity.

Windows: w32tm.exe Timer/Delay Usage via stripchart Parameters

Flags w32tm.exe executions using stripchart delay-related parameters that can support timed automation on Windows.

Windows UltraViewer Desktop App Execution

Alerts on execution of UltraViewer Desktop on Windows based on executable metadata in process creation events.

Windows Process Creation: NetSupport Client Configurator (PCICFGUI.EXE)

Alerts on execution of NetSupport Client Configurator (PCICFGUI.EXE) on Windows via process metadata.

Windows: Suspicious Parent Process Spawning cmd.exe

Alerts on cmd.exe executions that have a suspicious/atypical parent process among listed Windows binaries.

Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps

Flags renamed createdump.exe executions on Windows that use full dump flags and produce .dmp files.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell WMI Script Deletes Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

Windows Process Creation: Remote Utilities renamed to rutserv.exe or rfusclient.exe

Alerts on suspicious Windows execution tied to "Remote Utilities" where the image does not match known rutserv.exe/rfusclient.exe names.

Windows: Detects NetSupport RAT client32.exe execution using Imphash and filename metadata

Flags renamed NetSupport RAT client32.exe launches on Windows using a specific Imphash and file metadata, while filtering a matching image path.

Windows: RURAT (Remote Utilities) Executed From Unusual Path

Alerts on Remote Utilities RURAT executables running outside the typical Program Files install paths on Windows.

Windows: NetSupport client32.exe Executed From Non-Standard Directory

Flags NetSupport client32.exe launched from locations outside Program Files on Windows.

Windows: Detect winPEAS privilege escalation reconnaissance execution

Flags Windows executions of winPEAS/PEASS-ng based on image name and command-line discovery options and release download indicators.

Windows Registry: Tampering ChannelAccess Permissions for WINEVT Event Channels

Alerts on registry updates to WINEVT ChannelAccess that set SDDL permissions granting elevated access to event channels.