Sigma detection rules, expert-reviewed

Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)

Alert on regini.exe process executions whose command line contains an ADS-style colon pattern used for registry modification.

Windows: regedit.exe imports .reg via an alternate data stream (ADS)

Alerts when regedit.exe is used to import a .reg file using an alternate data stream pattern in the command line.

Windows Regedit Exports Registry Hives to Files

Flags regedit.exe command lines exporting SYSTEM/SAM/SECURITY hives from HKLM to files.

Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring

Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.

Detect Obfuscated PowerShell Command Invocation via Stdin on Windows

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

PowerShell Obfuscation Delivered via Stdin Using Set-and-Invoke Pattern

Detects obfuscated PowerShell script blocks that use chained stdin/environment/input patterns.

PowerShell Module: Obfuscated Script Execution via Stdin Pattern

Detects obfuscated PowerShell module payloads using chained set and stdin/input invoke patterns.

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

Windows System: Service Control Manager runs command with obfuscated PowerShell keywords via set and stdin

Alerts on service creation where ImagePath includes obfuscation-like command chaining with environment/invoke/input strings.

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

Windows Security Event 4697: Obfuscated PowerShell Invocation Through Stdin

Alerts on Service creation events where the service command line includes stdin-style PowerShell obfuscation indicators.

Windows Security: Remote DCOM IE DLL Hijack via iertutil.dll in Internet Explorer path

Flags network file writes of iertutil.dll under IE’s Program Files path associated with potential DCOM DLL hijacking.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.