Sigma detection rules, expert-reviewed

Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands

Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.

Windows svchost.exe Uncommon Command-Line Parameter Process Creation

Alerts on Windows process starts of svchost.exe that include an uncommon -k parameter format, after excluding common and benign patterns.

Windows CMD for /f Tokens= with Recursive Dir Listing

Flags cmd.exe for /f loops using tokens= with recursive dir enumeration in the command line and parent.

Windows Registry: Suspicious Space-Padded TypedPaths Details String

Alerts on registry writes to TypedPaths url1 where Details includes “#” plus unusual Unicode space padding.

Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter

Alerts on RunMRU registry updates containing '#' plus excessive unusual Unicode spaces that may conceal command text.

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Alerts when Explorer spawns a process with command lines containing long Unicode whitespace padding followed by '#'.

Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.

FortiGate SSL VPN Settings Edited

Flags FortiGate VPN SSL settings being edited, which may indicate changes to SSL VPN access or authentication configuration.

FortiGate User Group Modified via Edit Event

Alerts on FortiGate user group edits that can change access permissions, including VPN-related group membership.

FortiGate: Addition of VPN SSL Web Portal via Event Logs

Detects FortiGate configuration events where a VPN SSL web portal is added.

FortiGate: Local User Added via CLI Event

Alerts on FortiGate events where a new local user is added under user.local.

FortiGate: Alert on Added Firewall Policy via Event Log

Flags FortiGate events where a firewall policy is added (action Add on firewall.policy).

FortiGate Firewall Address Object Added (event action Add)

Alerts when a FortiGate firewall address object is added via configuration change events.

FortiGate: Administrator Account Added via system.admin Events

Alerts on FortiGate events that add a new administrator account in system.admin.

Windows Application Logs: Detect WSUS deserialization exploitation via InvalidCastException indicators

Flags WSUS (EventID 7053) application log errors matching invalid cast/object data provider strings indicative of CVE-2025-59287 exploitation.