Sigma detection rules, expert-reviewed

Windows Registry Changes for Outlook WebView Home Page URL Persistence

Alerts on Windows registry modifications affecting Outlook WebView home page URL settings.

BabyShark HackTool Proxy C2 URL Pattern via momyshark?key=

Alerts on proxy URIs containing the BabyShark agent default "momyshark?key=" query pattern.

Windows Registry: Microsoft Office Protected View Disabled via Security Policy Keys

Flags Windows registry updates that disable Microsoft Office Protected View for attachments, internet files, UNC paths, or unsafe locations.

Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.

Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

Alerts on deletion of AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI, potentially indicating AMSI inspection impairment.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.

Windows Sysmon Configuration Event Where Sysmon Stops

Alert on Sysmon status showing a stop event concurrent with a Sysmon configuration state change.

Windows Sysmon error events indicating service configuration update failures

Flags Windows Sysmon errors for failed service configuration/driver update attempts that may indicate tampering.

Windows Process Creation: SDelete Used for File Overwrite

Alerts when sdelete.exe runs in a way consistent with file overwrite to impede forensic recovery.

Windows WMI Shadow Copy Deletion via PowerShell

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

Windows Rundll32 Loads DLL Export StartNodeRelay (F-Secure C3)

Flags rundll32.exe launching a DLL that references the StartNodeRelay export in its command line.

Windows Rundll32 Used to Start Cobalt Strike DLL Load via StartW

Alerts on rundll32.exe command lines that include a .dll and StartW function, consistent with Cobalt Strike DLL loading.

Nginx service core dump after worker crash (signal 6)

Flags Nginx worker crashes that end with signal 6 core dumps, which may indicate serious issues or exploitation.