Sigma detection rules, expert-reviewed

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Copies a DLL into System32 or SysWOW64

Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.

Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks

Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.

Windows: cipher.exe Overwrites Deleted Data Using /w

Flags Windows cipher.exe runs with /w: to overwrite deleted data on disk.

Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo

Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.

Windows Process Termination via taskkill.exe Execution

Alerts on taskkill.exe executions that use /f along with /im or /pid to force-terminate targeted processes.

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

Java keytool Spawns System Shells or Scripting Utilities on Windows

Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.

Windows: Detect Computer Account Rename to Non-Standard Name Missing Trailing '$'

Alerts on Windows 4781 computer account renames where the new name lacks the '$' suffix.

Proxy requests with URI ending in .class extension

Flags proxy requests whose URI path ends with .class, useful for identifying potential Java class downloads.

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Alerts on Windows process executions using filenames that match common Sysinternals tools to indicate potential binary impersonation.

Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

Flags SYSTEM-context process executions on Windows that include suspicious tool names or command-line patterns such as PowerShell/Mimikatz indicators.

Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Flags reg.exe or PowerShell registry edits that alter the ms-settings protocol handler open command path.

Windows sqlcmd.exe Credential Dump Query Against VeeamBackup dbo

Alerts on sqlcmd.exe running a query targeting the VeeamBackup dbo Credentials table to dump sensitive credentials.