Sigma detection rules, expert-reviewed

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows curl.exe SOCKS Proxy and .onion Command-Line Execution

Alerts on Windows curl.exe being run with Tor SOCKS proxy URIs and .onion targets in the command line.

Windows File Events: Suspicious WDAC Policy File Creation by Non-Excluded Processes

Alerts on WDAC-related policy files created under CodeIntegrity, excluding known deployment tools and scripts.

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

Windows file creation of executable/script files in \Users\Public

Alerts on Windows file creation in \Users\Public\ with potentially malicious script/binary extensions.

Windows: Clfs.sys Loaded from Suspicious Process Image Paths

Alerts when clfs.sys is loaded by a process running from user/temp/perflogs-style suspicious paths on Windows.

Linux: Shell spawned by rsync without -e flag in command line

Flags rsync/rsyncd spawning a shell when rsync lacks the expected " -e " command-line flag.

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Detects registry changes to Windows Event Log ChannelAccess SDDL, which can limit event log visibility or control.

M365 Audit: Successful Intune Company Portal login via Cmsi

Flags successful Company Portal (Intune) logins via Cmsi audit events that may indicate Conditional Access bypass attempts.

Windows Application Error 1000 with lsass.exe and WLDAP32.dll Indicating LDAP Nightmare Attempt (CVE-2024-49113)

Alerts on Windows Application Error (EventID 1000) showing lsass.exe crashing in WLDAP32.dll—potential CVE-2024-49113 exploitation attempt.