Sigma detection rules, expert-reviewed

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Alerts when dism.exe loads a dismcore.dll that is not the expected System32 Dism DLL.

Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

Non-privileged reg.exe or PowerShell registry service configuration changes on Windows

Flags non-admin reg.exe or PowerShell activity targeting service registry configuration paths on Windows.

Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters

Alerts when Windows process command lines include Hydra -u/-p parameters with USER/PASS placeholders.

Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Flags HKCU DelegateExecute registry changes for COM hijack style persistence under the Folder shell open command.

Detect Wannacry killswitch DNS queries to hardcoded domains

Flags DNS lookups for known WannaCry killswitch domain strings and variants.

Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client

Alerts on Windows NetLogon ETW events indicating an allowed secure channel connection (Event ID 5829).

Windows Defender Windefend AMSI Detection (Event ID 1116)

Flags Windows Defender AMSI detections via windefend Event ID 1116 with SourceName set to AMSI.

Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url

Alerts when MpCmdRun.exe is executed with DownloadFile and url, indicating Defender utility file download behavior.

Windows Process Creation Indicators for Snatch Ransomware Word Document Droppers

Alerts on Windows process command lines showing instant safe-mode shutdown/reboot and stopping SuperBackupMan service.

Zeek: Public RDP Connections from Non-Private IPv4/IPv6 Ranges

Alert on Zeek-observed RDP connections originating from non-excluded IP ranges, suggesting external accessibility.