Sigma detection rules, expert-reviewed

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

Windows Registry-Based DLL Hijack via WAB.EXE Using WAB Registry DLLPath

Flags WAB.EXE DLLPath registry writes where the configured DLL path differs from the default.

Windows manage-bde.wsf via wscript/cscript Proxy Execution

Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.

Windows Process Command Line: Detect VAR++ LAUNCHER Obfuscated PowerShell

Flags Windows command lines showing VAR++ launcher-style obfuscated PowerShell execution through Invoke-Expression patterns.

Windows Process Creation: Obfuscated Cmd Uses clip.exe to Execute PowerShell

Alerts when cmd.exe uses obfuscated Clip.exe/clipboard calls to launch PowerShell.

Detect VAR++ LAUNCHER-Style Obfuscated PowerShell Command Block

Detects VAR++ LAUNCHER-like PowerShell obfuscation patterns in ScriptBlockText.

PowerShell Script Block Obfuscation via cmd/clipboard and clip.exe execution

Identifies obfuscated PowerShell script blocks launching clip.exe and chaining clipboard-related execution.

PowerShell Module: VAR++ LAUNCHER Obfuscation in Obfuscated Command Payload

Identifies obfuscated PowerShell module payloads matching a VAR++ LAUNCHER-style invocation pattern.

PowerShell Module: Obfuscated Clip.exe launcher using cmd with clipboard download payload

Detects obfuscated PowerShell module commands that run cmd with clip.exe/clipboard payload formatting.

Windows System: Detects Service Control Manager spawning obfuscated PowerShell via VAR++ LAUNCHER

Flags newly created Windows services whose ImagePath contains cmd chaining and obfuscated PowerShell launcher indicators.

Windows System Service Control: Obfuscated cmd Launching clip.exe for PowerShell

Flags service creation (Event 7045) with obfuscated cmd ImagePath using clip.exe/clipboard PowerShell execution patterns.

Windows Security 4697 Alert for Obfuscated PowerShell Invoke via VAR++ LAUNCHER

Alerts on obfuscated PowerShell launcher patterns in Windows service creation events (EID 4697) consistent with VAR++ LAUNCHER.

Windows Security Log: Obfuscated cmd Execution of clip.exe via PowerShell Clipboard Patterns (EID 4697)

Alerts on service creation (Windows 4697) with CLIP.exe command-line patterns that indicate obfuscated PowerShell execution.

Linux: Detect dd and truncate used to pad binaries and alter file contents

Flags Linux process executions of dd and truncate consistent with padding binaries to alter on-disk representation.

Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)

Alerts when wuauclt.exe is executed with UpdateDeploymentProvider/RunHandlerComServer-related parameters indicative of proxy execution.