Sigma detection rules, expert-reviewed

Windows Driver Load from Temporary Directory Paths

Detects Windows driver loads whose ImageLoaded path contains the temporary directory (\Temp\).

Windows Security: Detect LSASS handle access for SAM_DOMAIN (0x705)

Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.

Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)

Alerts on Windows Security failures for Kerberos TGT-related operations using specific Kerberos event IDs and status codes.

Windows Event Logs: Mimikatz Keyword Indicators

Detects Mimikatz-related keywords in Windows event logs while filtering Sysmon EventID 15 to limit noise.

Windows Security and Eventlog Cleared via Event IDs 517 or 1102

Flags Windows event log clearing using Security Event ID 517 and Microsoft-Windows-Eventlog Event ID 1102.

Windows Webshell Recon Command-Line Keywords via Web Server Processes

Flags Windows process chains where web server parents spawn reconnaissance- and execution-related command lines indicative of webshell activity.

Windows WerFault Access to lsass.exe Indicative of Credential Dumping Attempts

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.