Sigma detection rules, expert-reviewed

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Suspicious File Creation by OpenEDR ITSMService on Windows

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.

Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)

Alerts on WebHelpDesk (bin) spawning tool-like child processes with download/execution command patterns on Windows.

Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity

Detects PowerShell script content using Exchange cmdlets to create or update inbox rules with message-manipulation actions.

Windows Process Creation: node.exe Running npx skills add New Agent Skills

Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.

Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting

Flags registry changes that disable Windows Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0).

Windows Vulnerable Driver Blocklist Registry Tampering via PowerShell or REG.EXE

Flags PowerShell/REG.EXE command lines that change the VulnerableDriverBlocklistEnable registry setting under \Control\CI\Config.

Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

Windows Registry: Alert on Changes to \shell\open\command Targeting Common Malware Paths

Alerts on registry_set events modifying \shell\open\command to point to suspicious temp/user-writable locations.

Windows Registry Modification: OracleOciLib/OracleOciLibPath Under MSDTC for oci.dll Redirection

Alerts on MSDTC MTxOCI registry changes to OracleOciLib/OracleOciLibPath that may redirect oci.dll loading to attacker-controlled locations.

Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)

Alerts on cmd.exe invoking start.exe with /b or /min, especially when directed at scripts or files in suspicious temp/public paths.