Sigma detection rules, expert-reviewed

Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)

Alerts on ntdsutil.exe command lines that include snapshot mount and activation/instance fragments, indicating potential AD snapshot manipulation.

Windows UAC Bypass via Elevated COM interface using ICMLuaUtil

Flags dllhost.exe parent launches tied to elevated COM /Processid GUIDs consistent with UAC bypass behavior on Windows.

Windows: Taskkill used to terminate ccSvcHst.exe (Symantec Endpoint Protection service impairment)

Flags Windows taskkill /F /IM ccSvcHst.exe executions that can disable Symantec Endpoint Protection services.

Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution

Flags Windows executions of chisel.exe with client/server tunneling and SOCKS5 reverse arguments.

Windows Process Creation: 3proxy Proxy Server Execution

Detects execution of 3proxy.exe with local 127.0.0.1 proxy binding on Windows.

PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.

PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)

Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.

PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features

Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.

Windows Registry Winlogon AllowMultipleTSSessions Enabled

Alerts on enabling Winlogon AllowMultipleTSSessions (DWORD 0x00000001), allowing concurrent RDP sessions.

Windows Process Creation Recon via Event Log Query Tools and Event ID Searches

Flags Windows processes running event log query utilities and commands that search specific event IDs or dump log content.

Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types

Alerts on schtasks.exe commands that schedule tasks using ONLOGON/ONSTART/ONCE/ONIDLE with potentially malicious privilege context.

Windows schtasks Delete All Scheduled Tasks via /tn * /delete /f

Flags schtasks.exe commands that forcibly delete all scheduled tasks on the local host using /delete /tn * /f.

Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components

Alerts when schtasks.exe runs with /delete targeting sensitive Windows scheduled tasks that support security, updates, or recovery.

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.