Sigma detection rules, expert-reviewed

Windows DNS Queries for IP Lookup Service Domains from Non-Browser Processes

Flags suspicious DNS lookups to IP-check API domains on Windows when they come from non-browser executables.

Windows Process Creation: MpCmdRun.exe Removing All Windows Defender Definitions

Flags MpCmdRun.exe launched to remove all Windows Defender definition files.

Windows Registry Defender Exclusions Path Set (Microsoft\Windows Defender\Exclusions)

Identifies registry updates that reference the Windows Defender Exclusions path, indicating potential defense impairment.

Windows Defender Exclusions Added via Windefend (Event ID 5007)

Alerts on Windows Defender exclusion additions based on windefend Event ID 5007 configuration change events.

Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings

Flags Defender tamper protection blocks to disable key Microsoft Defender Antivirus and real-time protection settings.

Windows Registry: Flag Print Driver Registry Paths for QMS 810 and mimikatz

Detects registry TargetObject entries containing QMS 810 or mimikatz-related printer driver names under Windows print environments.

Windows Print Spooler Exploitation Indicators: UNIDRV.DLL and mimispool Driver Loads (Event ID 316)

Flags Windows Print Spooler Event ID 316 entries containing UNIDRV/mimispool-related keywords indicative of CVE-2021-1675 exploitation.

Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)

Alerts when spoolsv.exe deletes a DLL from the Spooler driver folder path on Windows.

Antivirus detections of PrinterNightmare PoC file creation path on Windows

Alerts on antivirus events where filenames include the Windows spooler driver x64 directory path, excluding Symantec submission messages.

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation

Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

Pulse Connect Secure web exploitation attempts for CVE-2021-22893

Detects web requests to Pulse Connect Secure with URI query patterns consistent with CVE-2021-22893 exploitation attempts.

Windows ImageLoad of DLL from spoolsv.exe spool drivers subfolders

Flags spoolsv.exe DLL loads originating from Print Spooler x64\3/x64\4 driver folders on Windows.