Sigma detection rules, expert-reviewed

Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.

Windows Registry: New ODBC Driver Registration in Suspicious Path

Alerts when Windows registers a new ODBC driver under the ODBCINST.INI area with details pointing to suspicious filesystem paths.

Windows: Odbcconf.EXE INSTALLDRIVER Use With Missing .dll Target

Flags odbcconf.exe running INSTALLDRIVER when the driver argument lacks a .dll extension.

Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

Windows Process Execution of Odbcconf.exe with -f Response File Flag

Alerts on Odbcconf.exe being run with -f to load a response file, excluding runonce-driven executions.

Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.

Windows Process Execution: odbcconf.exe with DLL in Suspicious Path

Flags odbcconf.exe process launches when the command line references DLL-related paths in suspicious Windows locations.

Windows Registry Run Key Persistence Using Small Sieve Typo Value Strings

Flags registry Run-key writes on Windows with Small Sieve-specific typo and executable detail strings in value data.

Windows Process Creation: Detects Command-Line Ending With '.exe Platypus'

Alerts when a Windows process command line ends with '.exe Platypus', matching a Small Sieve indicator.

Windows: Small Sieve IoC File Creation via AppData and Typo Filename Indicators

Alerts on Windows file events with Small Sieve filename typo/path indicators or the OutlookDataPlus.txt IOCs.

Windows WerFault ReflectDebugger Registry Key Value Targeting

Flags registry set events targeting WerFault ReflectDebugger under Windows Error Reporting Hangs for potential persistence abuse.

Windows CreateStreamHash: Suspicious Embedded File Download Indicators via .zip TLD

Flags Windows downloads indicating .zip/ plus ':Zone' in target filenames for risky executable or script extensions.

Windows: Suspicious rundll32 Execution of advpack.dll with Ordinal RegisterOCX Calls

Identifies rundll32.exe launching advpack.dll with ordinal-style calls consistent with stealthy OCX registration behavior.

AWS CloudTrail: S3 Browser Creates IAM User or Access Key

Alerts on CloudTrail IAM CreateUser/CreateAccessKey actions initiated by a "S3 Browser" user agent.

AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder

Detects S3 Browser–initiated IAM PutUserPolicy requests that include a templated S3 bucket placeholder in the inline policy.