Sigma detection rules, expert-reviewed

Windows conhost.exe Path Traversal in Process Command Line

Detects Windows conhost.exe command lines containing '/../../' path traversal indicators.

Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)

Flags GET requests containing SSTI probe strings in web access logs when the response is not 404.

Windows msdt.exe execution using PCWDiagnostic.xml answer file

Alerts on msdt.exe launched with PCWDiagnostic.xml and an answer-file argument, excluding cases from pcwrun.exe.

Windows: Indirect execution of pcwrun.exe using path traversal-style command line content

Detects pcwrun.exe spawning with '../' in the command line, indicating potential indirect execution abuse.

Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL

Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.

Windows: GUP Utility Spawns Commands from Explorer via Notepad++ Updater

Flags Notepad++ updater-launched GUP activity that causes explorer.exe to execute with notepad++ in the command line.

Windows: New Notepad++ plugins DLL written outside gup.exe

Alerts on creation of Notepad++ plugin DLLs by a process other than gup.exe, suggesting possible persistence via custom plugins.

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Identifies Microsoft BITS proxy connections where the destination host ends with a single-digit, indicating uncommon IP-style addressing.

Windows Process Execution via Squirrel.exe Proxy Arguments

Identifies Windows executions of Squirrel.exe/Update.exe that use processStart-style arguments to launch other processes.

Windows Process: Squirrel.exe Using Download/Update Flags to Fetch Files

Alert on Squirrel.exe/update.exe runs with --download/--update flags and HTTP in the command line.

Windows Process Creation: Mftrace.exe Child Process Execution

Alerts on child processes spawned by Mftrace.exe, which can be abused to execute arbitrary binaries on Windows.

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Flags Windows launches of VSIISExeLauncher.exe with "-p" and "-a" parameters, consistent with potential arbitrary binary execution.

Windows: Adplus.exe Execution with Memory Dump and Command Options

Alerts on Windows executions of Adplus.exe with memory-dump and inline command parameters.