Sigma detection rules, expert-reviewed

Sysmon Registry: .NET ETWEnabled Disabled via COMPlus ETW Flags

Alerts on Sysmon registry sets that set .NET ETWEnabled/COMPlus ETW flags to 0, impairing ETW-based telemetry.

Windows Registry ETW Logging Disabled for .NET via Security Event 4657

Alerts when .NET ETW logging is disabled via registry changes (ETWEnabled or COMPlus ETW settings) using Event ID 4657.

Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines

Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.

Windows Process Masquerading: msdtc.exe and gpsvc.exe launched from Non-System Paths

Alerts on msdtc.exe or gpsvc.exe launched from paths outside Windows System32/SysWOW64.

Windows Registry Set of ms-msdt MSProtocol URI (CVE-2022-30190)

Alerts on Windows registry writes under HKCR\ms-msdt\ that may indicate MSDT protocol abuse.

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

Windows: New Executables Named After System Processes in Non-System Paths

Alerts on creation of executables named like common system processes in unexpected Windows directories.

ComRAT Proxy HTTP Requesting index.php with h Parameter

Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.

Confluence CVE-2019-3398 Web Exploitation via Path Traversal Upload POST Request

Alert on Confluence POST /upload.action requests with query-based path traversal filename patterns consistent with CVE-2019-3398.

Windows process command lines matching May 2020 Turla ComRAT command patterns

Triggers on Windows command lines matching a set of Turla-related indicators documented by ESET (May 2020).

Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.

Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation

Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).

Windows Registry: Office VBAWarning Disabled (VBAWarnings set to 1)

Alerts on Security\VBAWarnings being set to DWORD 0x00000001, enabling all Office VBA macros.

Windows Registry Set AccessVBOM DWORD=1 Disables Access Security for Access VBA

Alerts on Windows registry changes setting Security\AccessVBOM to DWORD 1, disabling VBA trust access to bypass Office warnings.

Windows: CrackMapExec PowerShell obfuscation via join/split static patterns

Flags Windows PowerShell executions with command-line obfuscation strings associated with CrackMapExec behavior.