Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious Service Stop/Pause/Delete/Disable via net, sc, PowerShell

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows Process Creation: Suspicious ShellExec_RunDLL Command-Line Usage

Detects Windows command lines containing ShellExec_RunDLL along with other suspicious execution indicators.

Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)

Flags net.exe/net1.exe process creation when command lines reference built-in Administrator/guest/default accounts with suspicious active/disable context.

Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share

Flags cmd.exe command lines that mount an Internet WebDAV share with net use and immediately execute content from DavWWWRoot.

Windows Suspicious Process Execution Using GUID-Like Folder Names in %TEMP% or AppData

Hunts Windows processes whose command lines reference GUID-named folders in user AppData/Temp locations.

Windows schtasks.exe scheduled task creation or modification with high privileges on suspicious schedule types

Flags schtasks.exe commands that create/modify tasks to run on ONLOGON/ONSTART/ONCE/ONIDLE with SYSTEM or HIGHEST privileges.

Windows Process Creation: Wscript.Shell.Run keyword sequence in CommandLine

Alerts on Windows command lines containing Wscript.Shell.Run keyword sequence, suggesting script-driven shell execution.

Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)

Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.

Windows Network Connection from Cmstp.EXE (Outbound)

Alerts on outbound network connections initiated by cmstp.exe, which is uncommon and may indicate process misuse.

Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths

Alerts when cmstp.exe loads DLL/OCX from suspicious directories on Windows.

Windows RTCore64 Service Installation via Service Control Manager (Event ID 7045)

Alerts on creation of the RTCore64 Windows service via Service Control Manager Event ID 7045.

Windows SharpLdapWhoami Execution via LDAP Whoami Methods

Flags execution of SharpLdapWhoami on Windows using LDAP-related whoami alternative method parameters.

Potential DLL Sideloading via DeviceEnroller.exe Using /PhoneDeepLink

Alerts on deviceenroller.exe runs with /PhoneDeepLink, a potential DLL sideloading trigger referencing ShellChromeAPI.dll.

Windows Registry Detection: COM TreatAs(Default) Hijacking

Flags registry changes to COM TreatAs(Default) keys, excluding common Office/ClickToRun and installer processes.

Windows Process Creation: nimgrab.exe Execution (Nim Tool Download Behavior)

Alerts on execution of nimgrab.exe on Windows when hashes match known indicators.