Sigma detection rules, expert-reviewed

PowerShell AD Account Creation Library Usage via AccountManagement Namespace on Windows

Alert on PowerShell Script Block content referencing System.DirectoryServices.AccountManagement, indicating potential AD principal manipulation.

PowerShell Scheduled Task Creation via ScriptBlock Logging

Identifies PowerShell script blocks that create and register scheduled tasks using TaskScheduler cmdlets or CIM WMI method calls.

Windows PowerShell Screen Capture via CopyFromScreen

Flags PowerShell scripts containing .CopyFromScreen, indicative of desktop screen capture activity.

Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line

Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.

Windows Process Execution of Hashcat.exe for Password Cracking

Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.

Windows: Findstr searches GPP cpassword in SYSVOL XML

Alerts when Windows findstr/find searches SYSVOL XML files for GPP cpassword.

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Copies a DLL into System32 or SysWOW64

Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.

Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks

Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.

Windows: cipher.exe Overwrites Deleted Data Using /w

Flags Windows cipher.exe runs with /w: to overwrite deleted data on disk.

Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo

Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.

Java keytool Spawns System Shells or Scripting Utilities on Windows

Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Alerts on Windows process executions using filenames that match common Sysinternals tools to indicate potential binary impersonation.

Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

Flags SYSTEM-context process executions on Windows that include suspicious tool names or command-line patterns such as PowerShell/Mimikatz indicators.