Sigma detection rules, expert-reviewed

Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.

Windows Registry: New Root CA or AuthRoot Certificates Added to Certificate Stores

Alerts on registry certificate-store writes adding new Root/CA/AuthRoot certificates as binary blobs.

Windows Registry Key Change Disabling System Restore

Detects registry writes that disable Windows System Restore via policy/config keys set to DWORD 0x00000001.

Windows Registry Service Persistence via SafeBoot Control Keys

Flags Windows registry writes that configure a service to load in Safe Mode (SafeBoot Minimal/Network).

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.

Windows Registry Change Disabling Hidden and System File Display

Detects registry writes that disable Windows Explorer showing hidden/system files by setting Hidden and ShowSuperHidden to 0x0.

Windows PowerShell: Suspicious GetTypeFromCLSID and ShellExecute usage

Flags PowerShell script blocks that use GetTypeFromCLSID followed by ShellExecute.

Windows fsutil.exe Drive Enumeration via Process Execution

Flags fsutil.exe process launches with command lines referencing connected drive enumeration.

Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines

Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.

Windows PowerShell Download and Execution Cradles

Flags PowerShell commands that download remote content and immediately execute it using IEX/Invoke-Expression.

Azure Sign-in Logs: MFA Denied Based on Authentication Requirement

Flags Azure sign-ins requiring MFA where the status indicates "MFA Denied."

Windows: reg.exe Registry Tampering of Windows Defender Policy Keys

Detects reg.exe adding Defender DWORD policy values to disable or suppress multiple protection features via Windows registry.

Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line

Flags Windows command lines that alter LSA PPL-related Control\Lsa registry settings using reg.exe/PowerShell property changes.

Windows Suspicious Parent Processes: Unusual Child Creation by System Utilities

Alerts when predefined suspicious Windows parent executables spawn unusual or unrecognized child processes.