Sigma detection rules, expert-reviewed

Windows Formbook-style process execution deleting dropped payloads from AppData Temp via cmd

Flags Windows process creation where an .exe runs deletion commands to remove dropper artifacts from AppData Temp/Desktop.

Windows Process Creation: Emotet-like Command-Line Patterns

Alerts on Windows process executions with command-line indicators consistent with Emotet-like staging and encoded payload usage.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.

Windows fsutil.exe Suspicious USN Journal and File Zeroing Parameters

Alerts when fsutil.exe is run with USN journal deletion/creation or setZeroData-style file zeroing commands.

Windows Registry: Enable WDigest UseLogonCredential (Use clear-text logon credential setting)

Flags registry writes that enable WDigest UseLogonCredential, turning on potential clear-text credential storage.

Windows: WinRM inbound network connections to ports 5985/5986 for PowerShell remoting

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

Windows Suspicious Debugger Registration via Image File Execution Options

Alerts on Windows attempts to set Image File Execution Options debuggers for logon screen binaries via command-line arguments.

Windows Registry: Modification of WDigest IsCredGuardEnabled to Disable Credential Guard

Alerts on Windows registry changes to WDigest\IsCredGuardEnabled that may disable Credential Guard.

PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

Windows Security: SysKey-related LSA Registry Key Access (4656/4663)

Alerts on access to LSA registry keys used to compute SysKey based on Windows Security handle and registry object events.

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

Cisco AAA local account and remote authentication changes

Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.

Cisco IOS AAA Crypto PKI Export/Import Commands

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Flags Cisco network OS attempts to clear logs or archives via AAA command text.