Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious GUP.exe Execution from Non-Notepad++ Directories

Alerts on GUP.exe executions from unexpected directories on Windows, excluding known Notepad++ updater paths.

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Alerts on SysWOW64 remote thread creation initiated by script host or Office binaries consistent with CACTUSTORCH behavior.

Chafer malware C2 URLs with /asp.asp?ui= pattern over HTTP proxy

Flags proxy HTTP requests containing the C2 URI pattern /asp.asp?ui= associated with Chafer behavior.

Windows netsh.exe Used to Create RDP (3389) Port Forwarding

Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.

Windows RDP Logon Using Localhost IP Address

Alerts on successful Windows logons (EventID 4624, LogonType 10) originating from localhost IPs.

Windows Registry: New Security Support Provider (SSP) added to LSA configuration

Alerts when a new SSP is added to LSA Security Packages in the Windows registry, excluding msiexec-driven changes.

Windows Suspicious Child Processes Spawned by Web Server Executables

Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.

Windows Process Execution From Uncommon or Sensitive Directories

Alerts on process executions from uncommon/sensitive Windows directories, excluding specific IBM and Citrix updater paths.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.

Windows Cmdkey.EXE Cached Credential Reconnaissance

Alerts on cmdkey.exe running with -l to enumerate cached credentials on a Windows host.

Windows userinit.exe Spawns Uncommon Child Processes

Alerts when userinit.exe starts an unexpected child process during logon, suggesting potential persistence via modified logon behavior.

Windows Command Line Logon Script Persistence via UserInitMprLogonScript

Alerts when a Windows process command line references UserInitMprLogonScript, a potential logon-script persistence indicator.

Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled

Flags Windows process command lines that reference Outlook’s EnableUnsafeClientMailRules security setting.