Sigma detection rules, expert-reviewed

Windows SafeBoot Registry Key Deletion via reg.exe Command-Line

Flags reg.exe deleting the \SYSTEM\CurrentControlSet\Control\SafeBoot registry key via command line.

Windows mshta.exe launched with URL-based arguments (http/https/ftp)

Alerts when mshta.exe is executed with HTTP/HTTPS/FTP URLs in the command line, consistent with remote HTA execution.

Windows Registry Persistence: DbgManagedDebugger Debugger Value Added

Alerts on registry sets that add a Debugger value under DbgManagedDebugger, indicating potential crash-triggered persistence.

Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)

Alerts on Windows process launches whose Image path contains 8.3 short-name markers (~1\ or ~2\), excluding several known benign parents.

Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)

Alert on Windows command lines referencing 8.3 short paths (~1\, ~2\) that may indicate path obfuscation.

Windows Registry RDP Terminal Services Sensitive Settings Tampering

Flags Windows registry changes to sensitive RDP/Terminal Services settings such as shadowing, remote assistance, security, and InitialProgram.

Windows Process Creation: Image contains NTFS 8.3 short filename patterns

Flags process creation events where the Image contains Windows 8.3 short-name patterns (e.g., ~1.exe, ~2.ps1) to evade image-based detections.

Azure Audit Logs: User Added to Privileged Eligibility Role

Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.

Windows Exploit Guard Controlled Folder Access: Added Allowed Application for Blocked Path

Alerts when an app is added to Exploit Guard’s AllowedApplications list to bypass controlled folder restrictions for risky paths.

Windows Registry: Exploit Guard ProtectedFolders Value Deleted

Alerts on deletion of registry values under Exploit Guard Controlled Folder Access ProtectedFolders.

Windows Process Creation: wusa.exe Cab Extraction From Suspicious Directory Paths

Flags wusa.exe with /extract: originating from common temp/public paths, a potential CAB-based payload unpacking behavior.

Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)

Detects Windows command lines referencing NTFS 8.3 short names like ~1.exe or ~2.ps1.

Windows Process Creation: Remove-MpPreference Used to Tamper Windows Defender Settings

Flags process executions that call Remove-MpPreference with Defender tampering-related parameters.

Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

Windows Suspicious File Creation in AppData Outside Common Subdirectories

Alerts on new .exe/.dll/.ps1/.lnk and other files created under unusual AppData locations outside Local/LocalLow/Roaming.