Sigma detection rules, expert-reviewed

Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load

Flags PowerShell command lines containing Base64 fragments consistent with reflective .NET Assembly.Load usage.

Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions

Flags Windows BITS transfers saving local files with high-risk script/executable extensions while excluding common benign patterns.

Windows BITS Job Creation Triggered by PowerShell

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)

Alerts on new BITS job creation when bitsadmin.exe triggers it (BITS-Client EventID 3).

Windows PowerShell CommandLine downloads and executes via WebClient with IEX or DownloadFile

Alerts on PowerShell command lines that use WebClient downloads combined with IEX or DownloadFile, typical of staged payload execution.

Windows: Suspicious Process Spawn by Outlook Parent

Alerts on Windows process launches where Outlook.exe spawns known high-risk command execution binaries.

Windows Registry: Enable Microsoft DDE in Word or Excel Security Settings

Detects registry changes that enable or permit DDE server launch/lookup for Word or Excel.

Suspicious wuauclt.exe Process Creation on Windows with Empty Command-Line Flags

Alert on Windows Update Agent wuauclt.exe launches that have command lines ending with no flags/arguments.

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Alerts on processes launched from \Users\Public that execute common scripting/shell binaries or command-line markers.

Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands

Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.

Windows process creation: CrackMapExec execution via characteristic command-line flags

Alerts on Windows process creation showing CrackMapExec-style command-line flags for local auth and module execution.

Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload

Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.

Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns

Flags Windows process creation with wiper-like PowerShell comsvcs MiniDump and related command-line/paths.

Windows Process Command-Line Indicators of BlackByte Ransomware Activity

Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.

Windows Registry: Disable CrashDump via CrashControl DWORD value

Alerts on registry changes that disable Windows crash dumps by writing 0x00000000 to CrashControl.