Sigma detection rules, expert-reviewed

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Detects ADExplorer exporting an AD snapshot by writing .dat files on Windows.

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.

Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.

Windows Doppelganger (Doppelanger.exe) LSASS Dump Tool Execution

Alerts on Windows execution of Doppelganger.exe with matching IMPHASH values associated with LSASS dumping.

Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll

Alerts when regsvr32 is run silently to register NppShell.dll but the regsvr32 image isn’t from standard Windows system locations.

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Alerts on Windows DNS queries containing a base64-like credential target signature linked to Kerberos coercion via DNS spoofing.

Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing

Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.

Windows DLL Load Trusted Path Bypass via Spoofed Directory Paths with Extra Space

Flags Windows DLL loads from spoofed "C:\Windows \\System32"-style paths with an extra space to indicate trusted-path bypass attempts.

Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.

Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation

Flags suspicious child execution from WebDAV/UNC paths initiated by iediagcmd.exe or CustomShellHost.exe, consistent with CVE-2025-33053 exploitation.

Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)

Alerts when iediagcmd.exe or CustomShellHost.exe access WebDAV-hosted executables consistent with a potential RCE attempt.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.