Sigma detection rules, expert-reviewed

Windows Desktop Image Downloader Targeting Lock Screen Images with Suspicious File Types

Alerts on desktopimgdownldr-style lock screen image target writes to non-system paths with suspicious filename characteristics.

Apache Guacamole Linux: Two-User Session Presence Anomaly

Flags Guacamole sessions on Linux when telemetry indicates two users are present, suggesting anomalous or suspicious session activity.

Windows: Detect curl.exe upload/data flags indicative of possible exfiltration

Detects curl.exe executions with upload/form/data flags on Windows that may indicate potential data exfiltration, excluding localhost targets.

Windows Registry Printer Driver Installations with Empty Manufacturer Field

Alerts on Windows registry printer driver environment updates where Manufacturer is set to empty.

PowerShell Classic bXOR Operator Usage in Command Line

Identifies PowerShell classic executions from ConsoleHost using the -bxor operator in the command line.

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Alerts on AppLocker event IDs showing blocked execution of apps, scripts, DLLs, MSI, or packaged apps.

Windows Security Log: Denied Remote Desktop Logon (Event ID 4825)

Flags Windows denied RDP connection attempts from users lacking permission to log on remotely (Event ID 4825).

Windows Registry Event Triggered by RedMimicry Winnti Playbook (HTMLHelp\data)

Alerts on Windows registry events targeting HKLM\SOFTWARE\Microsoft\HTMLHelp\data associated with the RedMimicry Winnti playbook.

Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)

Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.

Suspicious WSMAN COM Provider Usage Without PowerShell Host (Windows)

Alerts on WSMAN COM provider activity where the host application is not PowerShell.exe in PowerShell Classic logs.

Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)

Detects Windows file drops of specific DLLs and a Windows Temp batch filename pattern associated with a Winnti dropper scenario.

Windows Process Creation: Detect reg.exe Add Control Panel CPL Items

Alerts on reg.exe adding Control Panel CPL items via CurrentVersion\Control Panel\CPLs, a common vector for stealthy execution/persistence.

Windows Process Creation: IE Security Registry Values Disabled via Command Line

Alerts on Windows command lines that set IE hardening-related registry values to disable security features.

Linux Remote File Copy via scp, rsync, or sftp

Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.

Windows Registry Modification via Process Creation Command Lines Indicative of Ke3chang/TidePool

Alerts on Windows process command lines that set IE hardening and related Internet Explorer registry properties consistent with Ke3chang/TidePool.