Sigma detection rules, expert-reviewed

Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download

Alerts on registry settings that redirect OneDrive update URL retrieval from UpdateOfficeConfig for internet downloads.

PowerShell: Signed UtilityFunctions.ps1 Loading Managed DLL via Proxy Execution

Flags PowerShell command lines referencing UtilityFunctions.ps1 with RegSnapin usage consistent with managed DLL proxy execution.

Windows: Pubprn.vbs Script Proxy Execution via script: Command Line

Flags command-line executions referencing Pubprn.vbs with 'script:' indicative of proxy script command execution on Windows.

Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

Alerts when PowerShell command lines contain encoded obfuscation patterns referencing Net.Webclient with anomalous casing.

Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.

Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable

Detects chained cmd/.bat staging that uses xcopy plus PowerShell/pwsh and attrib +h/+s to run a .bat.exe payload associated with Jlaive.

Windows: rundll32.exe launched by explorer.exe parent process

Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.

Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1

Alerts on PowerShell being launched with CL_mutexverifiers that proxies additional script execution.

PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions

Alerts on PowerShell command lines that call LoadAssemblyFromPath/LoadAssemblyFromNS in CL_LoadAssembly.ps1 context.

Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Applications Downloading Files via HTTP/HTTPS

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

Alerts on Windows process creation for ttdinject.exe (TTDInject.EXE), a time travel debugging component.