Sigma detection rules, expert-reviewed

Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation

Flags registry changes to targeted COM InprocServer32 CLSID paths tied to CVE-2021-31979/33771 exploitation behavior on Windows.

Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths

Flags Windows file events where the target filename matches paths tied to CVE-2021-31979/CVE-2021-33771 exploitation patterns.

Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Alerts when Serv-U (\Serv-U.exe) spawns typical command interpreters or execution utilities on Windows.

Windows reg.exe Used to Modify Security Service Start Parameters

Flags reg.exe registry changes that target Start parameters for common security and Windows Defender-related services.

Suspicious PowerShell Execution From Windows Temporary Folders on Windows

Alerts when PowerShell runs with command-line paths pointing to Windows temp directories, excluding some common benign installers.

Windows Process Creation: Serv-U CVE-2021-35211 Exploitation Command Pattern

Alerts on Windows process commands that combine 'whoami' with Serv-U-specific execution path and temp batch patterns tied to CVE-2021-35211.

Windows ProtocolHandler.exe Download via Embedded URL Schemes

Flags ProtocolHandler.exe executions with ftp/http/https URLs that indicate automated downloading on Windows.

Windows PowerShell: AtomicTestHarness Invoke-ATHRemoteFXvGPUDisablementCommand Abuse

Alerts on Windows process command lines invoking AtomicTestHarnesses RemoteFXvGPUDisablement PowerShell execution.

Windows: InfDefaultInstall.exe .inf Execution

Flags Windows process executions of InfDefaultInstall.exe that include an .inf argument in the command line.

Windows PowerShell Module Creation With RemoteFXvGPUDisablement ModuleContents

Flags PowerShell module creation where ModuleContents includes Get-VMRemoteFXPhysicalVideoAdapter.

Windows PowerShell ModuleContents Set to Get-VMRemoteFXPhysicalVideoAdapter

Alerts on PowerShell module creation embedding Get-VMRemoteFXPhysicalVideoAdapter, a potential precursor to RemoteFXvGPUDisablement.exe abuse.

Windows Uninstall CrowdStrike Falcon Sensor via WindowsSensor.exe /uninstall /quiet

Flags Windows processes uninstalling CrowdStrike Falcon Sensor using WindowsSensor.exe with /uninstall and /quiet.

Windows Process: SyncAppvPublishingServer.exe Executes PowerShell via PowerShell-encoded command

Alerts when SyncAppvPublishingServer.exe is launched with a command-line pattern indicative of PowerShell code execution.

Windows Process Injection via Mavinject Using INJECTRUNNING Flag

Alerts on Windows process creation using Mavinject with /INJECTRUNNING, indicative of DLL injection into a running process.

Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.