Sigma detection rules, expert-reviewed

Suspicious Inline JavaScript Execution by Node.js (node.exe) on Windows

Flags Windows command lines where node.exe is used with JavaScript execution indicators and module keywords consistent with malicious activity.

Windows Process Execution of JavaScript via Node.exe

Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.

Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe

Alerts on .library-ms file creation triggered by 7z.exe, winrar.exe, or explorer.exe, which may indicate forced-authentication style exploitation.

Suspicious cmd.exe execution from w3wp.exe tied to CentreStack portal.config (Windows process creation)

Alerts when w3wp.exe launches cmd.exe and its command line references \portal\portal.config, suggesting possible IIS app exploitation.

Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot

Flags registry set activity that adds the MiniNt key, which stops Windows Event Log from writing events after a reboot.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows Registry RunMRU Tampering with HTTP/HTTPS and Script Execution Indicators

Alerts on Windows RunMRU registry changes containing HTTP/HTTPS URLs plus captcha/automation or command execution indicators.

Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

Alerts when explorer.exe launches a .lnk and the command line contains suspicious whitespace padding used to hide extended arguments.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Process Creation: AdFind.exe Execution for Active Directory Recon

Alerts on Windows execution of AdFind.exe based on image/name and known imphash values indicative of AD reconnaissance.

Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions

Alerts on Zeek HTTP requests to low-reputation TLDs or URIs/MIME types consistent with executable payload delivery.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

Windows Image Load: Suspicious ksproxy.ax Loading Suggesting CVE-2024-35250

Flags Windows module loads of ksproxy.ax, a potential indicator of CVE-2024-35250 exploitation attempt activity.