Sigma detection rules, expert-reviewed

Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components

Alerts when schtasks.exe runs with /delete targeting sensitive Windows scheduled tasks that support security, updates, or recovery.

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.

Windows node.exe Execution with -e/--eval and suspicious child process usage

Alerts on node.exe started with -e/--eval and command-line indicators of child_process and net.socket connect activity.

Windows Process Creation: SharpEvtMute Execution (Event Log Tampering)

Alerts on SharpEvtMute.exe runs with event-log filter and encoded command-line parameters on Windows.

Windows SysmonEnte Process Access Attempt (Sysmon.exe/ Sysmon64.exe/ Sysmon64a.exe)

Flags attempts to access Sysmon binaries consistent with SysmonEnte execution based on TargetImage, GrantedAccess, and CallTrace.

Windows: Detect EvtMuteHook.dll Load by IMPHASH Match (SharpEvtMute)

Detects DLL loads with a specific IMPHASH consistent with EvtMuteHook.dll used for event log tampering.

Windows suspicious file download URLs using direct IP address with script/binary extensions

Alerts on Windows downloads from HTTP/HTTPS direct IP URLs targeting script/binary/shortcut-like filenames.

Windows Process Creation: WinAPI Function Names in Command-Line

Alerts on Windows processes whose command lines reference WinAPI functions/modules commonly used for dynamic invocation and memory/process manipulation.

Windows Process Creation: Renamed Sysinternals Sdelete Execution

Alerts on Windows processes created with OriginalFileName sdelete.exe but executed via renamed sdelete binary paths.

Windows SharpChisel Command-Line Execution via SharpChisel.exe

Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.

Windows: Detect QuarksPwDump.exe Credential Dumping via Command-Line Parameters

Flags QuarksPwDump.exe executions on Windows that attempt local/domain hash and related data dumping.

Windows File Events: Suspicious Executable File Name Creation

Alerts on Windows file creation with suspicious executable filename patterns, including .bat.exe/.sys.exe and deceptive path-based names.

Windows Registry Tampering Targeting Sophos AV Tamper Protection Enabled Flags

Flags Windows registry changes that disable Sophos AV tamper protection by clearing specific enabled DWORD values.