Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

Alerts when explorer.exe launches a .lnk and the command line contains suspicious whitespace padding used to hide extended arguments.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Process Creation: AdFind.exe Execution for Active Directory Recon

Alerts on Windows execution of AdFind.exe based on image/name and known imphash values indicative of AD reconnaissance.

Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions

Alerts on Zeek HTTP requests to low-reputation TLDs or URIs/MIME types consistent with executable payload delivery.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

Windows Image Load: Suspicious ksproxy.ax Loading Suggesting CVE-2024-35250

Flags Windows module loads of ksproxy.ax, a potential indicator of CVE-2024-35250 exploitation attempt activity.

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows curl.exe SOCKS Proxy and .onion Command-Line Execution

Alerts on Windows curl.exe being run with Tor SOCKS proxy URIs and .onion targets in the command line.

Windows File Events: Suspicious WDAC Policy File Creation by Non-Excluded Processes

Alerts on WDAC-related policy files created under CodeIntegrity, excluding known deployment tools and scripts.

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.