Sigma detection rules, expert-reviewed

Windows: conhost.exe spawned by uncommon parent process

Alerts on conhost.exe launched by an uncommon parent process, using process creation parent image and command-line context.

Windows: Suspicious Parent Process Spawning cmd.exe

Alerts on cmd.exe executions that have a suspicious/atypical parent process among listed Windows binaries.

Windows Process Creation: Uncommon Parent Process Launching link.exe

Alerts when link.exe is spawned with a parent process outside typical Visual Studio paths.

Windows: Suspicious CustomShellHost.exe execution spawned by non-Explorer parent

Alerts on CustomShellHost.exe executions where explorer.exe is not the expected parent process image.

Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL

Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.

Linux Java Process Launching Suspicious Shell and Scripting Children

Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.

Windows Office Child Process with Directory Traversal Patterns

Alerts on Office parent processes launching child commands containing directory traversal patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Windows: rundll32.exe launched by explorer.exe parent process

Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.

Windows Suspicious Parent Processes: Unusual Child Creation by System Utilities

Alerts when predefined suspicious Windows parent executables spawn unusual or unrecognized child processes.

Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands

Flags web server processes spawning child commands consistent with credential dumping, exfiltration, and privilege changes.

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Alerts on processes launched from \Users\Public that execute common scripting/shell binaries or command-line markers.

Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process

Alerts when macro-enabled Office files are created by common Windows script execution processes.

Windows UAC Bypass via ComputerDefaults.exe with Elevated Integrity Parent Process

Flags ComputerDefaults.exe runs at high/system integrity when the parent isn’t from typical system or Program Files paths.

Windows whoami.exe Execution from Suspicious Parent Processes

Alerts on whoami.exe runs where the parent process is not a typical shell or monitoring agent.