Sigma detection rules, expert-reviewed

Windows Registry: Exploit Guard ProtectedFolders Value Deleted

Alerts on deletion of registry values under Exploit Guard Controlled Folder Access ProtectedFolders.

Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths

Flags wusa.exe with /extract: originating from common temp/public paths, a potential CAB-based payload unpacking behavior.

Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)

Detects Windows command lines referencing NTFS 8.3 short names like ~1.exe or ~2.ps1.

Windows Process Creation: Remove-MpPreference Used to Tamper Windows Defender Settings

Flags process executions that call Remove-MpPreference with Defender tampering-related parameters.

Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

Windows Suspicious File Creation in AppData Outside Common Subdirectories

Alerts on new .exe/.dll/.ps1/.lnk and other files created under unusual AppData locations outside Local/LocalLow/Roaming.

Windows Defender Exploit Guard Tamper via Controlled Folder Access AllowedApplications or ProtectedFolders Changes

Alerts on Windefend EventID 5007 when Exploit Guard ProtectedFolders or AllowedApplications lists are modified.

Windows RDP Tunneling Using plink.exe on Local Port 3389

Alert on plink.exe command lines referencing 127.0.0.1:3389 or port 3389, suggesting potential RDP tunneling on Windows.

Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.

Windows PsExec Named Pipe Creation from Suspicious Paths (PSEXESVC)

Alerts on PsExec pipe \PSEXESVC creation when the executing image path is in public/temp/desktop/downloads locations.

Windows CLI usage of obfuscated IP address patterns in ping/arp commands

Alerts when ping or arp command lines include obfuscated/encoded IP address indicators on Windows.

Windows Process Creation: Obfuscated IP Address in Download Command URLs

Alerts on Windows download commands that include obfuscated/encoded IP addresses in the URL.

Windows named pipe creation matching DiagTrackEoP POC pipe name fragment

Flags Windows creation of a named pipe matching the DiagTrackEoP POC’s default pipe name.

Windows Security Mitigations: Unsigned DLL Blocked from User-Writable Paths

Alerts on blocked unsigned DLL loads targeting public, downloads, desktop, or temp directories in Windows Security Mitigations logs.

Windows Security: DiagTrackEoP POC Default UserName Login Attempt (LogonType 9)

Alerts on Windows 4624 LogonType 9 events targeting a known DiagTrackEoP default username.