Sigma detection rules, expert-reviewed

Windows: Detect sc.exe Service Creation with DACL Modification (sdset DCLCWPDTSD)

Alerts on sc.exe sdset usage with DCLCWPDTSD, suggesting permission changes to hide or impede service removal.

Windows reg.exe Credential Enumeration via Registry Query (HKLM/HKCU)

Flags reg.exe registry queries (REG_SZ, recursive) focused on HKLM/HKCU and PuTTY Sessions to enumerate credential material.

PowerShell Credential Manager enumeration via vaultcmd /listcreds

Flags PowerShell using vaultcmd /listcreds to enumerate Windows/Web credential manager stored entries.

PowerShell Credential Manager Credential Dump via Script Block Text Matching (Windows)

Alerts on PowerShell script blocks that invoke Windows Credential Manager credential retrieval functions.

PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

Windows: Process Execution of PsLogList with Event Log Dump/Export Flags

Detects PsLogList executions aimed at Security/Application/System logs with dump/export/clear command-line switches.

Windows CleanWipe-Like PUA Execution via System Tool Uninstall Switches

Flags Windows processes launching CleanWipe-like removal tools with uninstall parameters for security impairment investigation.

Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Flags Windows launches of Advanced Port Scanner with /portable and /lng parameters.

Windows Process Command-Line Flags Indicating Auditpol Policy Tampering

Detects auditpol runs with flags that disable key audit categories, indicating potential audit policy tampering for defense impairment.

Windows: java.exe Parent Spawning cmd/powershell/bash Processes

Alerts when java.exe launches cmd, PowerShell, or bash on Windows, a potential sign of command execution.

Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries

Triggers when java.exe launches a child utility commonly abused for command execution and administration.

Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)

Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.

PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.

Windows PowerShell: Query SMB Shares via Get-SmbShare

Alerts on PowerShell script blocks running Get-SmbShare to discover SMB shares.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.