Sigma detection rules, expert-reviewed

Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Binaries Downloading Files via HTTP(S) Potentially Arbitrary Payload

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

Alerts on Windows process creation for ttdinject.exe (TTDInject.EXE), a time travel debugging component.

Windows gpscript.exe Executes Group Policy Logon/Startup Scripts

Flags gpscript.exe running with /logon or /startup, suggestive of Group Policy script execution abuse.

Windows IEExec.EXE Download-and-Execute via Process Creation

Flags IEExec.exe executions that reference HTTP/HTTPS URLs for download-and-execute behavior.

Windows: File Download via CertOC.exe Using -GetCACAPS HTTP

Flags CertOC.exe launched with -GetCACAPS and an http URL, indicating a remote file retrieval attempt.

Windows Remote Thread Creation via Ttdinject.exe Proxy

Alerts on Windows create-remote-thread events initiated by Ttdinject.exe used as a proxy.

Windows Process Creation: reg.exe Adds Winlogon SpecialAccounts Userlist Value 0

Flags reg.exe command lines that add SpecialAccounts Userlist with /d 0 to hide accounts from the logon screen.

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.

Windows Service Creation for KrbRelayUp (KrbSCM)

Flags creation of the KrbSCM Windows service, a known KrbRelayUp installation artifact.

Windows PowerShell Execution of Obfuscated One-Liner for In-Memory Module Download

Alerts on Windows PowerShell one-liners containing an obfuscated in-memory download/execute pattern from an HTTP URL.

Windows: WerFault.exe/wer.dll File Creation in Uncommon Locations

Alerts on newly created WerFault.exe or wer.dll in non-standard locations, suggesting potential DLL hijacking activity.