Sigma detection rules, expert-reviewed

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.

Windows UAC bypass using wsreset.exe with high/SYSTEM integrity

Alerts when wsreset.exe is executed with elevated integrity (High or SYSTEM), indicating a potential UAC bypass attempt.

Windows Process UAC Bypass via Windows Media Player osksupport.dll (osk.exe → cmd.exe)

Alerts on osk.exe spawning cmd.exe under mmc event viewer with high/system integrity, consistent with a UAC bypass attempt.

Windows UAC Bypass via pkgmgr.exe Launching dism.exe (High/System Integrity)

Detects pkgmgr.exe spawning dism.exe with High/System integrity levels on Windows, a pattern used in UAC bypass attempts.

Windows UAC Bypass via consent.exe and werfault.exe with comctl32.dll-related behavior

Alerts on consent.exe parent launching werfault.exe with high/system integrity levels, consistent with potential UAC bypass attempts.

Windows UAC bypass via changepk.exe launched from slui.exe with elevated integrity

Flags changepk.exe execution from slui.exe with High/System integrity to identify potential UAC bypass behavior on Windows.

Windows Process Creation: Suspicious splwow64.exe Missing Command-Line Parameters

Flags Windows executions of splwow64.exe where the command line ends at the executable with no parameters.

Windows UAC Bypass via WoW64 Logger DLL Hijack (Process Access Pattern)

Flags SysWOW64 process-access behavior with high granted access and unknown call traces consistent with a WoW64 logger DLL hijack UAC bypass.

Windows Named Pipe Creation Matching EfsPotato-Style \\pipe\\srvsvc

Alerts on Windows named pipe creation events matching an EfsPotato-style PipeName pattern (\pipe\ and \pipe\srvsvc), excluding common benign contexts.

UAC Bypass via Windows Media Player: DllHost.exe spawning osk.exe writing OskSupport.dll to Temp

Flags file events where Temp\OskSupport.dll is targeted alongside DllHost.exe and Windows Media Player\osk.exe, consistent with a UAC bypass attempt.

Windows UAC Bypass via consent.exe with comctl32.dll file path pattern

Detects suspicious target path patterns involving consent.exe.@ and comctl32.dll consistent with UAC bypass staging.

Windows Office Applications Creating Executable/Script Files with Suspicious Extensions

Flags Office application processes creating .exe/.dll/.ps1 and other script or executable files on Windows.

Windows: Suspicious explorer.exe Child Process Spawned by RazerInstaller.exe

Flags explorer.exe spawned by RazerInstaller.exe when the installer runs at System/high integrity.

PowerShell Write-Hijack HackTool Creates .bat for DLL Hijack Execution (Windows)

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

Antivirus alerts on known hacktool and attack tool signatures

Alerts on Antivirus detections matching hacktool signature prefixes or offensive tool names for investigation.