Sigma detection rules, expert-reviewed

Windows MeshAgent Remote Access Tool Command Line Execution Indicators

Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.

Windows Impacket-Pattern File Creation: sessionresume_[a-zA-Z]{8} Indicator

Flags Windows file creations of filenames matching Impacket sessionresume pattern ('sessionresume_<8 letters>').

Windows WER BugCheck Crash Dump Reporting via Event ID 1001

Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.

Suspicious Inline JavaScript Execution by Node.js (node.exe) on Windows

Flags Windows command lines where node.exe is used with JavaScript execution indicators and module keywords consistent with malicious activity.

Windows Process Execution of JavaScript via Node.exe

Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.

Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot

Flags registry set activity that adds the MiniNt key, which stops Windows Event Log from writing events after a reboot.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows Registry RunMRU Tampering with HTTP/HTTPS and Script Execution Indicators

Alerts on Windows RunMRU registry changes containing HTTP/HTTPS URLs plus captcha/automation or command execution indicators.

Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

Alerts when explorer.exe launches a .lnk and the command line contains suspicious whitespace padding used to hide extended arguments.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Process Creation: AdFind.exe Execution for Active Directory Recon

Alerts on Windows execution of AdFind.exe based on image/name and known imphash values indicative of AD reconnaissance.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows File Events: Suspicious WDAC Policy File Creation by Non-Excluded Processes

Alerts on WDAC-related policy files created under CodeIntegrity, excluding known deployment tools and scripts.