Sigma detection rules, expert-reviewed

Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries

Triggers when java.exe launches a child utility commonly abused for command execution and administration.

Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)

Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.

Windows wbadmin.exe Deletes All Backup Copies (keepVersions:0)

Flags wbadmin.exe executions that delete all backups/system state backups using keepVersions:0.

Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

Webserver JNDI-Exploit-Kit Exploitation Indicators via Known Payload Paths

Flags webserver requests whose URL paths match known JNDI-Exploit-Kit exploit, deserialization, and memshell pattern strings.

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Alerts when SharpView.exe runs with command-line indicators of AD and network discovery/enumeration activity.

Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer

Flags webserver requests with ${jndi:...} payloads in User-Agent, URI query, or Referer indicative of Log4Shell attempts.

Webserver detection of Log4j RCE (CVE-2021-44228) JNDI injection patterns

Detects webserver traffic containing Log4Shell-style JNDI injection payload strings, excluding Nessus scan artifacts.

Windows Process Creation: Executable Image Missing Absolute Path (Possible Process Ghosting)

Flags Windows process creation where the executable Image lacks an absolute path, potentially indicating process ghosting.

Windows: Suspicious PowerShell Interactive History Files Created as SYSTEM

Alerts on creation of PowerShell interactive history/profile files under SYSTEM, signaling privileged PowerShell activity.

Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell

Detects Windows command-line activity that adds a user to the local Remote Desktop Users group using net localgroup or Add-LocalGroupMember.

Windows Process Command Line Containing Whoami as First Parameter

Flags Windows process creations with command lines containing '.exe whoami' to surface potential discovery behavior.

Windows Regsvr32.exe Executed with Suspicious File Extension Masquerading as DLL

Alerts when REGSVR32.exe runs with a command-line argument ending in a suspicious masquerade file extension.

Windows File Writes from NPPSpy Hacktool: NPPSpy.txt and NPPSpy.dll

Alerts on Windows file events writing NPPSpy.txt or NPPSpy.dll, consistent with credential dumping by the NPPSpy hacktool.

Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder

Alerts on Visual Studio–staged dump64.exe masquerading, potentially indicating an attempt to bypass Windows Defender AV.