Sigma detection rules, expert-reviewed

Linux: Detect dd and truncate used to pad binaries and alter file contents

Flags Linux process executions of dd and truncate consistent with padding binaries to alter on-disk representation.

Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)

Alerts when wuauclt.exe is executed with UpdateDeploymentProvider/RunHandlerComServer-related parameters indicative of proxy execution.

Windows WMIC process creation with suspicious command execution

Alerts on WMIC spawning new processes with command-line indicators of common execution/payload binaries on Windows.

Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)

Alert on regini.exe process executions whose command line contains an ADS-style colon pattern used for registry modification.

Windows: regedit.exe imports .reg via an alternate data stream (ADS)

Alerts when regedit.exe is used to import a .reg file using an alternate data stream pattern in the command line.

Windows Regedit Exports Registry Hives to Files

Flags regedit.exe command lines exporting SYSTEM/SAM/SECURITY hives from HKLM to files.

Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring

Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.

Windows Indirect Command Execution via Program Compatibility Assistant pcwrun.exe

Alerts on child processes spawned by pcwrun.exe, indicating indirect command execution via Program Compatibility Assistant.

Detect Obfuscated PowerShell Command Invocation via Stdin on Windows

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

Windows Process Creation: AtBroker.exe Launching Assistive Technology Apps

Alerts on Windows process starts of AtBroker.exe with "start" that don’t match known built-in accessibility parameters.

PowerShell Obfuscation Delivered via Stdin Using Set-and-Invoke Pattern

Detects obfuscated PowerShell script blocks that use chained stdin/environment/input patterns.

PowerShell Module: Obfuscated Script Execution via Stdin Pattern

Detects obfuscated PowerShell module payloads using chained set and stdin/input invoke patterns.

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll Image Load

Alerts when iexplore.exe loads iertutil.dll from an Internet Explorer path, indicating possible DLL hijacking.

Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem

Alerts when System creates wbemcomn.dll in C:\Windows\System32\wbem\, consistent with WMI DLL hijack file staging.