Sigma detection rules, expert-reviewed

Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access

Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.

Windows process contacting Dropbox API from non-Dropbox executables

Alerts when a non-Dropbox executable makes initiated connections to Dropbox API endpoints on Windows.

Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation

Alerts when 7zFM.exe spawns cmd.exe or PowerShell with command-line patterns consistent with CVE-2022-29072 exploitation attempts.

Windows schtasks.exe scheduled task creation from suspicious folders

Alerts on schtasks.exe /create using PowerShell/cmd and suspicious folder paths like ProgramData.

Windows Network Connections Initiated by Eqnedt32.EXE

Identifies outbound network connections started by eqnedt32.exe on Windows.

Windows RPCSS svchost (-k RPCSS) Process Spawn Anomaly (Potential CVE-2022-26809)

Alerts on svchost.exe running RPCSS spawning anomalous child processes indicative of potential RPC abuse.

Windows File Creation: PowerShell webAdministration Module Path Used in CVE-2022-24527 LPE

Flags Windows file events creating webAdministration.psm1 under PowerShell modules, consistent with CVE-2022-24527 LPE behavior.

Windows Process Creation: SQLite Access to Firefox Profile Databases

Alerts when Windows runs SQLite tooling to query Firefox profile DBs like cookies.sqlite or places.sqlite.

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.

Windows PowerShell execution from C:\Users\Public

Flags PowerShell command lines that reference C:\Users\Public, indicating likely script execution from a common public staging area.

Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line

Alerts on suspicious command-line usage of DumpMinitool.exe on Windows, leveraging process creation Image, OriginalFileName, and command-line text.

Windows Registry Key Change Disabling System Restore

Detects registry writes that disable Windows System Restore via policy/config keys set to DWORD 0x00000001.

Windows Registry Service Persistence via SafeBoot Control Keys

Flags Windows registry writes that configure a service to load in Safe Mode (SafeBoot Minimal/Network).

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.

Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines

Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.