Sigma detection rules, expert-reviewed

Windows PowerShell Uninstall-WindowsFeature/Remove-WindowsFeature Removing Windows-Defender GUI

Detects PowerShell uninstall/removal commands targeting the Windows-Defender GUI feature.

VBScript Registry Write Attempt via Wscript.shell RegWrite on Windows

Flags command lines containing Wscript.shell CreateObject and RegWrite, indicating VBScript-driven registry modification attempts.

PowerShell VBScript RegWrite Registry Modification Attempts

Identifies PowerShell commands embedding VBScript Wscript.shell .RegWrite to modify Windows registry values.

Windows File Creation of .funksec Ransom Note Extension

Flags Windows file creations where the new filename ends with .funksec, consistent with FunkLocker-encrypted file naming.

DNS Queries to Low-Reputation Effective TLDs (eTLD) via Known Bad TLD List

Alerts on DNS queries targeting domains under known low-reputation eTLD suffixes from an external threat-intel list.

Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)

Flags proxy GET requests using the Hello-World/1.0 user-agent, which may indicate automated scraping.

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Detects CrushFTP launching PowerShell/CMD and related LOLBins with command patterns consistent with RCE exploitation behavior.

Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

Windows: Suspicious Attachment File Created in Outlook Temp Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.

IIS Web Logs: SharePoint ToolPane and spinstall0.aspx CVE-2025-53770 Exploitation Indicators

Alerts on IIS log traffic to SharePoint ToolPane/spinstall0 endpoints with a SignOut referer, matching indicators for CVE-2025-53770 exploitation.

Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)

Alerts on w3wp.exe command lines containing encoded spinstall0.aspx and SharePoint template layout path indicators consistent with CVE-2025-53770 exploitation.