Every published rule

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

Windows: New Executables Named After System Processes in Non-System Paths

Alerts on creation of executables named like common system processes in unexpected Windows directories.

Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.

Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation

Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).

Windows Registry: Office VBAWarning Disabled (VBAWarnings set to 1)

Alerts on Security\VBAWarnings being set to DWORD 0x00000001, enabling all Office VBA macros.

Windows Registry Set AccessVBOM DWORD=1 Disables Access Security for Access VBA

Alerts on Windows registry changes setting Security\AccessVBOM to DWORD 1, disabling VBA trust access to bypass Office warnings.

Windows: CrackMapExec PowerShell obfuscation via join/split static patterns

Flags Windows PowerShell executions with command-line obfuscation strings associated with CrackMapExec behavior.

Windows NTLM Logon to TERMSRV on Non-Domain Hosts

Alerts on Windows NTLM events tied to TERMSRV targets that may be non-domain hosts, suggesting potential RDP access.

Windows Network Connections Initiated by Notepad.exe

Alerts when notepad.exe initiates an outbound network connection, excluding typical printing traffic on port 9100.

Windows: Detect rar.exe Archive Creation Using Password or Compression Options

Alerts on rar.exe command lines that include both password protection (-hp) and additional compression/archive flags.

Windows: Advanced IP Scanner (PUA) Execution via Process Creation

Identifies Windows processes running Advanced IP Scanner using filename/description and command-line arguments.

Advanced IP Scanner Execution from Temp Folder via Windows File Events

Flags file activity targeting Advanced IP Scanner 2 under a Windows user Temp directory.

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Security Log: Metasploit SMB NTLM Logon (4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

Windows Failed Logon (Event ID 4625) From Non-Private Public IP

Alerts on Windows failed logons (4625) originating from IPs outside private/local ranges.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows AppCompatFlags Store New Application Registry Entries

Alerts on new writes to the AppCompat Compatibility Assistant store registry path, indicating first-time application behavior.

Windows Registry Deletion of Shell Open Command COM Hijacking Key Paths

Flags registry deletions of \shell\open\command paths that may indicate removal of COM hijacking execution entries.

Windows sdclt.exe Spawned with High Integrity (Possible UAC Bypass)

Alerts on sdclt.exe launching as High integrity, indicating possible elevated execution consistent with UAC bypass attempts.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.