Sigma detection rules, expert-reviewed

Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows Process Creation: Suspicious cmd.exe Launch with Encoded PowerShell from Cleo Suite

Alerts on cmd.exe launching PowerShell encoded commands from Cleo javaw.exe components with .Download.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes

Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.

Windows DISM Enables PowerShell Web Access Feature via Command Line

Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.

Windows PowerShell Web Access Installation via PowerShell Script Block

Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.

Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.

Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"

Alerts on net.exe or PowerShell attempts to create a domain group named "ESX Admins" via AD/command-line parameters.

PowerShell Launch With --headless From Conhost.exe on Windows

Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.

Suspicious PowerShell Execution of DSInternals Cmdlets on Windows

Flags PowerShell command lines invoking specific DSInternals cmdlets that can support AD/credential and key material operations.