Sigma detection rules, expert-reviewed

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.

Windows Process Termination via taskkill.exe Execution

Alerts on taskkill.exe executions that use /f along with /im or /pid to force-terminate targeted processes.

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

Java keytool Spawns System Shells or Scripting Utilities on Windows

Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.

Windows: Detect Computer Account Rename to Non-Standard Name Missing Trailing '$'

Alerts on Windows 4781 computer account renames where the new name lacks the '$' suffix.

Proxy requests with URI ending in .class extension

Flags proxy requests whose URI path ends with .class, useful for identifying potential Java class downloads.

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Alerts on Windows process executions using filenames that match common Sysinternals tools to indicate potential binary impersonation.

Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

Flags SYSTEM-context process executions on Windows that include suspicious tool names or command-line patterns such as PowerShell/Mimikatz indicators.

Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Flags reg.exe or PowerShell registry edits that alter the ms-settings protocol handler open command path.

Windows sqlcmd.exe Credential Dump Query Against VeeamBackup dbo

Alerts on sqlcmd.exe running a query targeting the VeeamBackup dbo Credentials table to dump sensitive credentials.

Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)

Alerts on sc.exe sdset usage with DCLCWPDTSD, suggesting permission changes to hide or impede service removal.

Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)

Flags reg.exe registry queries (REG_SZ, recursive) focused on HKLM/HKCU and PuTTY Sessions to enumerate credential material.

PowerShell Credential Manager enumeration via vaultcmd /listcreds

Flags PowerShell using vaultcmd /listcreds to enumerate Windows/Web credential manager stored entries.

PowerShell Credential Manager Credential Dump via Script Block Text Matching (Windows)

Alerts on PowerShell script blocks that invoke Windows Credential Manager credential retrieval functions.

PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.