Sigma detection rules, expert-reviewed

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Applications Downloading Files via HTTP/HTTPS

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows IEExec.EXE Download-and-Execute via Process Creation

Flags IEExec.exe executions that reference HTTP/HTTPS URLs for download-and-execute behavior.

Windows Remote Thread Creation via Ttdinject.exe Proxy

Alerts on Windows create-remote-thread events initiated by Ttdinject.exe used as a proxy.

Windows Service Creation for KrbRelayUp (KrbSCM)

Flags creation of the KrbSCM Windows service, a known KrbRelayUp installation artifact.

Windows PowerShell Execution of Obfuscated One-Liner for In-Memory Module Download

Alerts on Windows PowerShell one-liners containing an obfuscated in-memory download/execute pattern from an HTTP URL.

Windows Security Event 5379: Opened Password-Protected ZIP from Outlook Attachment

Flags Windows events where a password-protected ZIP is opened from Outlook Temporary Internet Files.

Windows Security: Password-Protected ZIP Opened with Suspicious Filename Indicators

Alerts when Windows opens password-protected ZIP contents with filenames commonly tied to invoices, orders, payments, and deliveries.

Windows Process Creation: Cobalt Strike module/command strings entered in cmd.exe

Alerts when cmd.exe command lines include Cobalt Strike module/command strings.

Windows Process Command Line: Accidental Cobalt Strike Commands in cmd.exe

Flags cmd.exe executions whose command lines include known Cobalt Strike command terms.

Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Flags cmd.exe with /r from external media launching msiexec.exe /q that includes an HTTP/HTTPS payload URL.

Windows: Raspberry Robin Command Execution via fodhelper.exe and rundll32/regsvr32

Flags Windows process-spawn chains where fodhelper.exe runs rundll32/regsvr32 with Raspberry Robin-style command-line patterns.

Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe

Alerts when regsvr32.exe spawns suspicious child processes like PowerShell, mshta, or scripting utilities.