Sigma detection rules, expert-reviewed

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.

Webserver Detection of POST Logupload Attempt for VMware View Planner CVE-2021-21978

Alerts on webserver POST requests targeting logupload/logMetaData parameters tied to CVE-2021-21978 probing.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

Windows: Detect Microsoft Exchange CVE-2020-0688 exploitation via Eventlog errors

Identifies Exchange Control Panel error events containing a ViewState parameter consistent with CVE-2020-0688 exploitation attempts.

Webserver Request Matching for CVE-2020-0688 Exploitation Attempt

Alerts when webserver URI queries include /ecp/default.aspx with __VIEWSTATEGENERATOR and __VIEWSTATE consistent with CVE-2020-0688 probing.

Detect Potential SQL Injection Payloads in GET URIs via Webserver Access Logs

Flags HTTP GET URIs containing SQL injection indicator strings in webserver access logs, excluding 404 responses.

Windows: Office Application Loads VBE VBA DLLs via Image Load Events

Flags Office apps loading VBA-related VBE DLLs, a strong indicator of VBA macro execution.