Sigma detection rules, expert-reviewed

Windows Microsoft Sync Center (mobsync.exe) Network Connections to Public IPs

Alerts when mobsync.exe makes outbound connections to destination IPs outside private/local ranges.

Windows: Copying Executable or DLL Files into Default GPO Policies Folder

Alerts when .exe/.dll files are created in the default GPO storage folder path.

Windows: Files created by Microsoft Sync Center (mobsync.exe) with .dll/.exe extensions

Flags .dll and .exe files created by mobsync.exe on Windows.

Windows: rundll32.exe spawning explorer.exe child process (shell32.Control_RunDLL)

Alerts on rundll32.exe spawning explorer.exe, an uncommon child process pattern that may indicate stealthy execution via shell components.

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Flags Windows process creation for KrbRelay.exe with Kerberos relaying-related command-line arguments.

Windows Hacktool Execution via PE Metadata Company Field

Flags execution of Windows binaries with PE Company metadata set to "Cube0x0", even when renamed.

Windows UAC Bypass via Event Viewer RecentViews File Creation

Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.

Windows: Detect .SCR screen saver file creation outside common system directories

Alerts on creation of .scr screen saver files in unusual locations on Windows.

Windows Successful Local Kerberos Logon to Built-in Administrator (Possible Privilege Escalation)

Alert on successful local (127.0.0.1) Kerberos logons targeting the built-in Administrator SID for potential privilege escalation.

Windows: Detect KrbRelayUp.exe HackTool Process Execution

Flags Windows process executions of KrbRelayUp.exe with relay/domain and SCM spawn command-line patterns.

Windows LsaSrv Events Indicating NTLMv1 Logon Between Client and Server

Flags LsaSrv events 6038/6039 showing NTLMv1 authentication between client and server on Windows.

Windows Sysmon Application Popup Crash (Event ID 26)

Flags Application Popup events reporting sysmon64.exe/sysmon.exe “Application Error” (Event ID 26).

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)

Alerts when prunsrv.exe spawns PowerShell or cmd.exe running PowerShell, consistent with potential Workspace ONE Access RCE attempts.

Windows msiexec.exe Command Line Loading a DLL and Calling DllUnregisterServer

Alert when msiexec.exe runs with -z and a .dll on the command line, consistent with DLL DllUnregisterServer execution.