Sigma detection rules, expert-reviewed

Windows File Creation in SharePoint Web Server Extensions Suggesting ToolShell Drop

Alerts on Windows file creations within SharePoint Web Server Extensions that match suspicious spinstall/debug artifacts linked to CVE-2025-53770.

Windows: WinRAR/Rar.exe Writing Files to Startup Folder Locations

Alerts on WinRAR/Rar creating files under the Windows Startup folder, a common persistence attempt.

Windows Scheduled Task Creation via schtasks.exe Using sshd/ssh.exe for Tunnel Setup

Alerts when schtasks.exe creates scheduled tasks that invoke sshd.exe or ssh.exe with tunnel-related arguments.

Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"

Alerts when a registry key tied to the Defender “Scan with” context menu is deleted, excluding MsMpEng.exe activity.

Windows PowerShell sets Microsoft Defender threat severity default actions to Allow/NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Detects ADExplorer exporting an AD snapshot by writing .dat files on Windows.

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.

Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.

Windows Doppelganger (Doppelanger.exe) LSASS Dump Tool Execution

Alerts on Windows execution of Doppelganger.exe with matching IMPHASH values associated with LSASS dumping.

Windows: Suspicious regsvr32 invocation by Notepad++ installer referencing NppShell.dll

Alerts when regsvr32 is run silently to register NppShell.dll but the regsvr32 image isn’t from standard Windows system locations.

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Alerts on Windows DNS queries containing a base64-like credential target signature linked to Kerberos coercion via DNS spoofing.

Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing

Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.