Sigma detection rules, expert-reviewed

PowerShell Hyper-V Cmdlets Execution via Script Blocks (New-VM, Set-VMFirmware, Start-VM)

Alerts when PowerShell script blocks use Hyper-V VM creation or start cmdlets (New-VM, Set-VMFirmware, Start-VM).

Windows File Access to Browser Credential Stores by Uncommon Processes

Detects suspicious process access to Firefox/Chromium credential store files on Windows, excluding common system and known benign paths.

Windows Credential Manager Enumeration via VaultCmd.exe /listcreds

Flags VaultCmd.exe executions that enumerate saved Windows Credential Manager entries using /listcreds.

Windows Process Creation: SQLite Access to Firefox Profile Databases

Alerts when Windows runs SQLite tooling to query Firefox profile DBs like cookies.sqlite or places.sqlite.

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.

Windows PowerShell execution from C:\Users\Public

Flags PowerShell command lines that reference C:\Users\Public, indicating likely script execution from a common public staging area.

Windows Process Creation: Node.js Executions from Adobe Creative Cloud

Flags Windows executions of Adobe Creative Cloud’s bundled node.exe, excluding typical JS resource paths.

Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line

Alerts on suspicious command-line usage of DumpMinitool.exe on Windows, leveraging process creation Image, OriginalFileName, and command-line text.

Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping

Identifies Windows executions of DumpMinitool.exe variants with dump options via process creation telemetry.

Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.

Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

Alerts on registry certificate-store writes adding new Root/CA/AuthRoot certificates as binary blobs.

Windows Registry Key Change Disabling System Restore

Detects registry writes that disable Windows System Restore via policy/config keys set to DWORD 0x00000001.

Windows Registry Service Persistence via SafeBoot Control Keys

Flags Windows registry writes that configure a service to load in Safe Mode (SafeBoot Minimal/Network).

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.