Sigma detection rules, expert-reviewed

Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.

Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

Alerts on deletion of AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI, potentially indicating AMSI inspection impairment.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.

Windows Sysmon Configuration Event Where Sysmon Stops

Alert on Sysmon status showing a stop event concurrent with a Sysmon configuration state change.

Windows Sysmon error events indicating service configuration update failures

Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.

Windows Process Creation: SDelete Used for File Overwrite

Alerts when sdelete.exe runs in a way consistent with file overwrite to impede forensic recovery.

Windows WMI Shadow Copy Deletion via PowerShell

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

Windows Rundll32 Loads DLL Export StartNodeRelay (F-Secure C3)

Flags rundll32.exe launching a DLL that references the StartNodeRelay export in its command line.

Windows Rundll32 Used to Start Cobalt Strike DLL Load via StartW

Alerts on rundll32.exe command lines that include a .dll and StartW function, consistent with Cobalt Strike DLL loading.

Nginx service core dump after worker crash (signal 6)

Flags Nginx worker crashes that end with signal 6 core dumps, which may indicate serious issues or exploitation.

Windows Security Event 4663: ISO CD-ROM device mount activity

Alerts on Windows file-access events consistent with ISO mounting by activity under \\Device\\CdRom.

Windows rundll32.exe Started Without Command-Line Parameters

Alerts on Windows process launches of rundll32.exe with no parameters, excluding likely benign parent paths.

Windows: regedit.exe launched with TrustedInstaller or Process Hacker parent

Alerts when regedit.exe is launched by TrustedInstaller.exe or ProcessHacker.exe.

Windows Service Control Manager: ProcessHacker service runs as LocalSystem

Flags Windows service installs for ProcessHacker-prefixed services running as LocalSystem.

Windows: Rclone Configuration File Creation via rclone config path

Alerts on creation of rclone config files under a Windows user profile path.