Sigma detection rules, expert-reviewed

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Detects CrushFTP launching PowerShell/CMD and related LOLBins with command patterns consistent with RCE exploitation behavior.

Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

Windows: Suspicious Attachment File Created in Outlook Temp Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.

IIS Web Logs: SharePoint ToolPane and spinstall0.aspx CVE-2025-53770 Exploitation Indicators

Alerts on IIS log traffic to SharePoint ToolPane/spinstall0 endpoints with a SignOut referer, matching indicators for CVE-2025-53770 exploitation.

Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)

Alerts on w3wp.exe command lines containing encoded spinstall0.aspx and SharePoint template layout path indicators consistent with CVE-2025-53770 exploitation.

Windows File Creation in SharePoint Web Server Extensions Suggesting ToolShell Drop

Alerts on Windows file creations within SharePoint Web Server Extensions that match suspicious spinstall/debug artifacts linked to CVE-2025-53770.

Windows: WinRAR/Rar.exe Writing Files to Startup Folder Locations

Alerts on WinRAR/Rar creating files under the Windows Startup folder, a common persistence attempt.

Windows Scheduled Task Creation via schtasks.exe Using sshd/ssh.exe for Tunnel Setup

Alerts when schtasks.exe creates scheduled tasks that invoke sshd.exe or ssh.exe with tunnel-related arguments.

Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"

Alerts when a registry key tied to the Defender “Scan with” context menu is deleted, excluding MsMpEng.exe activity.

Windows PowerShell sets Microsoft Defender threat severity default actions to Allow/NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.