Sigma detection rules, expert-reviewed

Windows Registry User Profile Creation: ANONYMOUS _DomainUser_ Entries in ProfileList

Alerts on ProfileList registry writes indicating a new user profile with 'ANONYMOUS' and '_DomainUser_' markers.

Windows svchost.exe Loading newdev.dll from AppData Roaming (Potential Persistence)

Alerts on svchost.exe loading newdev.dll from AppData\Roaming, an unusual pattern consistent with stealthy persistence.

Windows Process Execution with User Name "ANONYMOUS" from System32 or AppData

Alerts on Windows process executions where the user is marked "ANONYMOUS" and the parent path is in System32 or AppData.

Windows: Detect newdev.dll created in AppData\Roaming\ starting from C:\Users\

Detects creation of newdev.dll under a user’s AppData\Roaming directory for potential user-scoped persistence.

Windows File Creation of dllhost.exe in Public Documents Used by COLDSTEEL RAT Variants

Flags creation of C:\users\public\Documents\dllhost.exe on Windows, matching an indicator seen in some COLDSTEEL RAT variants.

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Identifies PowerShell ScriptBlock content that includes Rubeus-specific Kerberos and ticket manipulation flags.

Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)

Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.

Linux Python Reverse Shell via pty and socket Module Execution

Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.

Windows Application: MSMQ Corrupted Packet (Event ID 2027, Level 2)

Alerts on MSMQ Event ID 2027 (level 2) indicating corrupted packets received by the service.

Windows: Suspicious child processes spawned by pc-app.exe (PaperCut MF/NG potential exploitation)

Alert on pc-app.exe spawning common command or scripting utilities on Windows.

Windows Log4j/Wstomcat-related Process Execution via ws_tomcatservice.exe Parent

Detects processes spawned by ws_tomcatservice.exe on Windows, excluding repadmin.exe, to surface potential Tomcat exploitation.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows mstsc.exe launched with a local .rdp file from suspicious paths

Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.

Windows: Uncommon Process Creates .rdp Remote Desktop File

Alerts on creation of .rdp files by processes that are not typically associated with producing them on Windows.

Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer

Alerts on winget staging under Temp\WinGet combined with ZoneTransfer ZoneId=3 and Zone.Identifier ADS contents.