Sigma detection rules, expert-reviewed

Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting

Flags registry changes that disable Windows Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0).

Windows Vulnerable Driver Blocklist Registry Tampering via PowerShell or REG.EXE

Flags PowerShell/REG.EXE command lines that change the VulnerableDriverBlocklistEnable registry setting under \Control\CI\Config.

Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection

Alerts on MSDTC MTxOCI registry changes to OracleOciLib/OracleOciLibPath that may redirect oci.dll loading to attacker-controlled locations.

OpenCanary RDP New Connection Attempt on Application Logtype 14001

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

OpenCanary Application Logs: Detect SYN Port Scan Targets on a Hosted Node

Flags OpenCanary events indicating the host was probed with a TCP SYN port scan.

OpenCanary application logs: detect NMAP XMAS scans targeting an OpenCanary node

Detects OpenCanary log events showing an Nmap Xmas scan targeting the monitored node.

OpenCanary: Detect NMAP OS Scan Targets via Application Logtype 5002

Alerts when OpenCanary records an NMAP OS scan event (logtype 5002), indicating host fingerprinting activity.

OpenCanary - Nmap NULL Scan Targeting Detected

Detects OpenCanary logtype 5003 events consistent with NMAP NULL scan targeting.

OpenCanary Application Logs: Nmap FIN Scan Targeting (Logtype 5005)

Detects Nmap FIN scan targeting against an OpenCanary node using application logs with logtype 5005.

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

Windows: Kernel Driver Utility (KDU) and hamakaze.exe Execution

Alerts on KDU/hamakaze.exe launches with command-line parameters associated with kernel driver loading.

Windows devcon.exe Command Line Disabling VMware VMCI Device

Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.

Windows Registry Set: Disable Windows Credential Guard by Zeroing EnableVirtualizationBasedSecurity

Alerts on registry value changes that zero Credential Guard/LSA configuration flags to disable virtualization-based secret protection.

Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags

Flags deletion of Credential Guard/LSA-related registry values that may weaken virtualization-based secret protection.