Sigma detection rules, expert-reviewed

Windows fsutil.exe Drive Enumeration via Process Execution

Flags fsutil.exe process launches with command lines referencing connected drive enumeration.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

Windows: Executable Creates Executable via File Creation Events

Flags .exe-to-.exe executable drops on Windows when a running executable creates another .exe, with exclusions for common system/update paths.

Windows BITS Job Creation Triggered by PowerShell

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)

Alerts on new BITS job creation when bitsadmin.exe triggers it (BITS-Client EventID 3).

Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)

Alert on Windows Firewall/Defender firewall setting changes using Events 2002, 2003, 2008, 2082, and 2083.

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Flags Windows where Windows Defender Firewall is reset to default settings via firewall-as events.

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Alert on Event ID 2009 when the Windows Defender Firewall service cannot load Group Policy.

Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)

Flags Windows Defender Firewall exception list changes (Event IDs 2005/2073), indicating potential attacker-driven network access changes.

Windows: attrib.exe Executed with +s to Mark Files as System Files

Flags attrib.exe executions that include the +s switch to mark target files as system files.

PowerShell Mount-DiskImage with -ImagePath to Access Disk Images

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

Windows Installer Application Removed via MsiInstaller Events

Alerts on Windows Installer events indicating an application was removed via MsiInstaller.