Sigma detection rules, expert-reviewed

Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process

Alerts on unsigned loading of dbghelp.dll/dbgcore.dll, often associated with memory dump creation and credential-access workflows.

Windows Remote Thread Creation Triggered by Uncommon Source Images

Detects remote thread creation on Windows when the SourceImage is one of several uncommon executables.

Windows Remote Thread Creation from Uncommon Parent Image

Alerts on remote thread creation on Windows when the source executable is rare, with exclusions for known benign image pairings.

Windows: Child Process Spawned with SYSTEM Integrity by LOCAL/NETWORK SERVICE Parent

Alert on Windows executions where a SYSTEM-integrity child is spawned by a LOCAL SERVICE or NETWORK SERVICE parent, excluding a specific rundll32 pattern.

Windows: sc.exe Service Configuration Changed by Medium-Integrity Users

Alerts on sc.exe runs from Medium-integrity users that include service config/binPath or failure command changes.

Windows Service Configuration Tampering by Medium-Integrity Processes

Alerts on medium-integrity processes running commands that target registry service configuration values for potential privilege escalation.

Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command

Alerts when services.exe spawns cmd/%COMSPEC% commands writing to a named pipe consistent with getsystem behavior.

Windows: DXCap.exe Used with -c to Launch Arbitrary Binaries

Flags Windows executions of DXCap.EXE using -c, a pattern that can launch arbitrary binaries or packages.

Windows: Process Creation of Dnx.EXE May Indicate Application Whitelisting Bypass

Alerts on execution of dnx.exe, a .NET-based utility that can be abused to bypass application whitelisting.

Windows: Suspicious Cdb.EXE Proxy Execution via Debugger Script Parameters

Alerts on cdb.exe starting with debugger script arguments that may be used to execute arbitrary commands.

Windows: Uncommon Child Processes Spawned by Bginfo.exe

Flags unusual processes launched by Bginfo.exe/ Bginfo64.exe that may indicate abused proxy execution.

Windows Security Audit: Registry Handle Write Access Requested for Defender Exclusions

Alerts on registry access requests with write/append permissions to Windows Defender exclusions key paths.

Windows Registry: Windows Defender Exclusions Key Modified via ObjectName Match

Alerts on registry value changes under the Windows Defender Exclusions key in Windows Security event 4657.

Windows Registry: Wow6432Node NT CurrentVersion Autorun Keys Modification

Alerts on registry modifications to Wow6432Node NT CurrentVersion autorun-related keys tied to persistence behavior.

Windows Registry: Wow6432Node Classes Autorun/ASEP Key Modification via ShellEx/CLSID Paths

Alerts on registry writes to Wow6432Node Classes ASEP-related ShellEx/CLSID key paths commonly used for persistence.