Sigma detection rules, expert-reviewed

Windows Registry: User Account Changed for FAX Service

Flags registry changes that alter the FAX service’s associated user account on Windows.

Windows UAC Bypass via iscsicpl.exe DLL Search Order Hijacking (iscsiexe.dll)

Detects iscsicpl.exe loading iscsiexe.dll from outside C:\Windows, consistent with UAC bypass DLL hijacking.

Windows System Process Loads DLL from Suspicious or Permissive Paths

Alerts when a Windows system process loads a DLL from permissive or suspicious directories.

Windows Process Creation: NTVDM (ntvdm.exe/csrstub.exe) Start for 16-bit App Compatibility

Flags creation of NTVDM-related processes (ntvdm.exe or csrstub.exe) used to run legacy 16-bit/DOS applications on Windows.

Windows Process Initiated Connections to Ngrok Domains

Alerts when a Windows process initiates an outbound connection to ngrok domain hostnames, which may indicate staging or C2 activity.

Windows Scheduled Task Creation Triggered Once at 00:00 Using Scripted Commands

Alerts on suspicious schtasks.exe task creation for a one-time 00:00 run with embedded script/command execution strings.

Sysmon DNS Query for anonfiles.com Domain

Flags Windows Sysmon DNS queries referencing anonfiles.com to support detection of suspicious data staging.

Windows Suspicious Service Creation via sc.exe or PowerShell New-Service with Abnormal Binary Paths

Flags service creation commands (sc.exe/New-Service) when the specified binary path includes suspicious directories or script/loader utilities.

Windows: Detect sc.exe Creating Kernel Driver Services

Flags sc.exe service creation where the command-line specifies a kernel driver type and binPath.

MSSQL sp_procoption Startup Execution Set/Clear via Application Log EventID 33205

Alerts on MSSQL sp_procoption being set or cleared for automatic startup execution via EXEC (EventID 33205).

Windows/MSSQL: Detect ALTER SERVER AUDIT or DROP SERVER AUDIT executions

Alerts on MSSQL ALTER/DROP SERVER AUDIT statements that disable or delete server audit coverage.

Windows MSSQL: Add Member to sysadmin Server Role (EventID 33205)

Alerts on MSSQL EventID 33205 when an ALTER SERVER ROLE command adds a member to the sysadmin role.

Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0

Alerts on Windows registry updates that set Winlogon SpecialAccounts Userlist to DWORD 0 to hide users.

Windows: Base64-Encoded PE “MZ” Header Present in Command Line

Alerts when Windows command lines include Base64 strings matching a PE “MZ” header.

Windows: Local user creation via net.exe with expires:never

Flags net.exe user add commands that set expires:never for local account persistence.