Sigma detection rules, expert-reviewed

Windows LsaSrv Events Indicating NTLMv1 Logon Between Client and Server

Flags LsaSrv events 6038/6039 showing NTLMv1 authentication between client and server on Windows.

Windows Sysmon Application Popup Crash (Event ID 26)

Flags Application Popup events reporting sysmon64.exe/sysmon.exe “Application Error” (Event ID 26).

Windows msiexec.exe Command Line Loading a DLL and Calling DllUnregisterServer

Alert when msiexec.exe runs with -z and a .dll on the command line, consistent with DLL DllUnregisterServer execution.

PowerShell WMI Win32_Product MSI Installation via Invoke-CimMethod

Flags PowerShell using WMI Win32_Product via Invoke-CimMethod to invoke an MSI install.

Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path

Alerts on creation of Get-Variable.exe in Local\Microsoft\WindowsApps, a potential cmdlet-path hijack.

Windows Remote Thread Created in KeePass.exe

Flags remote thread creation targeting KeePass.exe, a possible indicator of credential theft.

Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access

Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.

Windows process contacting Dropbox API from non-Dropbox executables

Alerts when a non-Dropbox executable makes initiated connections to Dropbox API endpoints on Windows.

Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh

Alerts when cmd/powershell launches msiexec.exe with -Embedding, a proxy execution pattern.

Windows Registry: Delete SD Value Under Schedule\TaskCache\Tree to Impair Scheduled Task Visibility

Detects deletion of the SD registry value under Schedule\TaskCache\Tree, which can impair scheduled task visibility.

Windows schtasks.exe scheduled task creation from suspicious folders

Alerts on schtasks.exe /create using PowerShell/cmd and suspicious folder paths like ProgramData.

Windows Network Connections Initiated by Eqnedt32.EXE

Identifies outbound network connections started by eqnedt32.exe on Windows.

PowerShell Hyper-V Cmdlets Execution via Script Blocks (New-VM, Set-VMFirmware, Start-VM)

Alerts when PowerShell script blocks use Hyper-V VM creation or start cmdlets (New-VM, Set-VMFirmware, Start-VM).

Windows Credential Manager Enumeration via VaultCmd.exe /listcreds

Flags VaultCmd.exe executions that enumerate saved Windows Credential Manager entries using /listcreds.

Windows Process Creation: SQLite Access to Firefox Profile Databases

Alerts when Windows runs SQLite tooling to query Firefox profile DBs like cookies.sqlite or places.sqlite.