Sigma detection rules, expert-reviewed

Windows Suspicious File Download Streams From File/Paste Hosting Domains With Script Extensions

Alert on Windows file stream hash creation involving downloads from paste/file-sharing domains targeting .bat/.cmd/.ps1 content indicators.

Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites

Identifies Windows stream-hash events tied to downloads from file-sharing/paste domains with Zone-tagged payload extensions.

Windows Registry: New NetworkProvider service keys indicative of credential dumping

Alerts on registry additions/changes to NetworkProvider service entries that may be used to dump clear-text credentials.

Windows Process Creation Using the Sysnative Directory Path

Alerts on process executions referencing \Windows\Sysnative, excluding common ngen.exe and a known XAMPP bat launcher.

Windows Process Creation: Suspicious CLI NetworkProvider Addition for Credential Dumping

Alerts on Windows CLI executions that reference services\... and NetworkProvider, a pattern consistent with credential dumping via provider changes.

Windows cmd.exe Command-Line Anomaly: Missing Spaces Around /c /k /r

Flags cmd.exe invocations with suspicious missing spaces around /c, /k, or /r based on process creation CommandLine patterns.

Windows Registry Persistence Risk: TypedPaths Key Modified by Non-Explorer Processes

Alerts on changes to Explorer TypedPaths registry entries from processes other than explorer.exe.

Windows Rundll32 Masquerading: DllRegisterServer CommandLine Not Using rundll32.exe

Alerts when 'DllRegisterServer' appears in the command line while the executing image is not rundll32.exe.

Windows Command-Line Persistence via TypedPaths Registry Modification

Flags command-line activity referencing the Explorer TypedPaths registry path, which may indicate persistence via registry modification.

Windows PUA CsExec Execution via Process Creation

Flags Windows process creation of csexec.exe (CsExec) consistent with remote execution tooling usage.

Windows Process Creation: Uncommon Parent Process Launching link.exe

Alerts when link.exe is spawned with a parent process outside typical Visual Studio paths.

Windows Process Creation: Renamed AdFind.exe Executions

Detects renamed AdFind.exe executions using AdFind-style domain discovery command-line indicators, OriginalFileName, and known binary hashes.

Windows PowerShell Command History Disable via Remove-Module psreadline

Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.

Windows Script Dropped by Signed Applications and LOLBINs

Detects Windows legitimate/signed executables dropping script files (.ps1, .vbs, .js, etc.) to disk, indicating potential script-based abuse.

Windows Suspicious App and LOLBIN Dropping Executable Files to Disk

Alerts on Windows processes like Office/LOLBINs writing .exe/.dll and other executable-equivalent files to disk.