Sigma detection rules, expert-reviewed

Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

Alerts on Windows registry writes to a specific Services\wercplsupport\Parameters\ServiceDll target path.

Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.

Windows Registry Ports Key Changes with Script/Binary File Indicators

Flags registry modifications to the Ports key with path- or executable/script-like details that may indicate printer-based exploitation attempts.

Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths

Flags suspicious Add-PrinterPort usage referencing .exe/.dll/.bat or “Generic / Text Only” in Windows process command lines.

Windows: Detect rar.exe Archive Creation Using Password or Compression Options

Alerts on rar.exe command lines that include both password protection (-hp) and additional compression/archive flags.

Windows: Advanced IP Scanner (PUA) Execution via Process Creation

Identifies Windows processes running Advanced IP Scanner using filename/description and command-line arguments.

Advanced IP Scanner Execution from Temp Folder via Windows File Events

Flags file activity targeting Advanced IP Scanner 2 under a Windows user Temp directory.

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations

Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.

Azure Activity Logs: Granting Role Assignments from New Source IPs

Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.

Azure Activity Logs: High Rate of VM Creations or Deployment Writes

Flags Azure activity log events showing VM creation or deployment write operations occurring at an anomalously high volume.

Windows Security Log: Metasploit SMB NTLM Logon (4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

Windows Failed Logon (Event ID 4625) From Non-Private Public IP

Alerts on Windows failed logons (4625) originating from IPs outside private/local ranges.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.