Sigma detection rules, expert-reviewed

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

Windows Process Execution via Squirrel.exe Proxy Arguments

Identifies Windows executions of Squirrel.exe/Update.exe that use processStart-style arguments to launch other processes.

Windows Process: Squirrel.exe Using Download/Update Flags to Fetch Files

Alert on Squirrel.exe/update.exe runs with --download/--update flags and HTTP in the command line.

Windows Process Creation: Mftrace.exe Child Process Execution

Alerts on child processes spawned by Mftrace.exe, which can be abused to execute arbitrary binaries on Windows.

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Flags Windows launches of VSIISExeLauncher.exe with "-p" and "-a" parameters, consistent with potential arbitrary binary execution.

Windows: Adplus.exe Execution with Memory Dump and Command Options

Alerts on Windows executions of Adplus.exe with memory-dump and inline command parameters.

Windows File Creation of .diagcab Packages

Alerts on newly created Windows .diagcab files that may indicate malicious packaging or exploitation.

Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)

Alerts when WinRAR/7-Zip/PeaZIP spawns ISO image tools, a pattern consistent with archive-delivered ISO payloads.

Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags

Alerts on renamed Plink executions using SSH port forwarding flags in Windows process creation logs.

Windows Office Startup Folder File Creation with Uncommon Extension

Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.

Windows rundll32 Locks Workstation via user32.dll LockWorkStation

Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Windows Process Creation: Renamed msdt.exe Execution

Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.