Sigma detection rules, expert-reviewed

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties

Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

PowerShell Downgrade Attempts via -Version 2 on Windows Process Creation

Alerts on PowerShell executions specifying a -Version 2 argument, consistent with potential downgrade attempts.

Windows Desktop.ini Accessed by Uncommon Process

Alerts when unexpected processes create or access Desktop.ini, which can be abused to change how Explorer displays folder contents.

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.

Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence

Alerts on specific Zeek DCE-RPC endpoint/operation combinations linked to Windows persistence techniques.

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Detects Zeek DCE-RPC calls that match execution-related JobAdd, Task Scheduler, WMI, or service create/start operations.

Windows Process Execution of .SettingContent-ms Command Line

Flags Windows processes whose command lines reference .SettingContent-ms, a potential trigger for setting-based execution.

Windows: Alert on Uncommon Child Process Executed from Appvlp.exe

Alerts on unusual child processes created by Appvlp.EXE on Windows, indicating potential command execution abuse.

Webserver Detection of POST Logupload Attempt for VMware View Planner CVE-2021-21978

Alerts on webserver POST requests targeting logupload/logMetaData parameters tied to CVE-2021-21978 probing.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.