Sigma detection rules, expert-reviewed

Windows: Detect reg.exe Deletion of RunMRU Registry Key

Alerts on reg.exe commands that delete the RunMRU registry key, clearing Run dialog command history.

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Flags Windows execution of trufflehog.exe, especially when targeting common code and collaboration platforms and using --results=verified.

Windows Process Execution of EDR-Freeze Tool

Flags execution of EDR-Freeze on Windows using image-name and IMPhash matches associated with the tool.

Windows Process Creation: WerFaultSecure.exe PPL Tampering with Dump/Impair Parameters

Alerts on WerFaultSecure.exe executions with PPL-related dump/impair command-line parameters that may target sensitive security protections.

Windows Process Creation: Command-Line Deletion of IIS Logs

Flags command-line attempts on Windows to delete IIS logs using common deletion utilities and the \inetpub\logs\ path.

Windows: Suspicious Velociraptor Child Process Execution Indicators

Alerts when Velociraptor.exe spawns specific child processes tied to tunneling, msiexec web installs, or PowerShell download commands.

Windows PowerShell Uninstall-WindowsFeature/Remove-WindowsFeature Removing Windows-Defender GUI

Detects PowerShell uninstall/removal commands targeting the Windows-Defender GUI feature.

VBScript Registry Write Attempt via Wscript.shell RegWrite on Windows

Flags command lines containing Wscript.shell CreateObject and RegWrite, indicating VBScript-driven registry modification attempts.

PowerShell VBScript RegWrite Registry Modification Attempts

Identifies PowerShell commands embedding VBScript Wscript.shell .RegWrite to modify Windows registry values.

Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

Windows: Suspicious Attachment File Created in Outlook Temp Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.