Sigma detection rules, expert-reviewed

Windows: Suspicious Attachment File Created in Outlook Temp Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.

Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)

Alerts on w3wp.exe command lines containing encoded spinstall0.aspx and SharePoint template layout path indicators consistent with CVE-2025-53770 exploitation.

Windows: WinRAR/Rar.exe Writing Files to Startup Folder Locations

Alerts on WinRAR/Rar creating files under the Windows Startup folder, a common persistence attempt.

Windows Scheduled Task Creation via schtasks.exe Using sshd/ssh.exe for Tunnel Setup

Alerts when schtasks.exe creates scheduled tasks that invoke sshd.exe or ssh.exe with tunnel-related arguments.

Windows PowerShell sets Microsoft Defender threat severity default actions to Allow/NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.

Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.

Windows Doppelganger (Doppelanger.exe) LSASS Dump Tool Execution

Alerts on Windows execution of Doppelganger.exe with matching IMPHASH values associated with LSASS dumping.

Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll

Alerts when regsvr32 is run silently to register NppShell.dll but the regsvr32 image isn’t from standard Windows system locations.

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Alerts on Windows DNS queries containing a base64-like credential target signature linked to Kerberos coercion via DNS spoofing.

Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing

Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.