Sigma detection rules, expert-reviewed

Windows adidnsdump Execution via python.exe

Detects python.exe running adidnsdump, a DNS-record enumeration tool used for internal AD recon.

Windows: Suspicious Process Execution of hostname.exe

Flags execution of hostname.exe from process creation events on Windows for discovery activity.

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo

Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.

Windows Process Termination via taskkill.exe Execution

Alerts on taskkill.exe executions that use /f along with /im or /pid to force-terminate targeted processes.

Windows PowerShell: Query SMB Shares via Get-SmbShare

Alerts on PowerShell script blocks running Get-SmbShare to discover SMB shares.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

PowerShell Module: Get-SmbShare Used for SMB Share Discovery

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

Windows process execution of where.exe with browser bookmark database or history artifacts

Alerts on where.exe executions referencing browser history/bookmarks/cookie database artifacts in the command line.

Windows CMD dir /S File and Subfolder Enumeration

Flags cmd.exe executions using dir with the /S flag to enumerate files in a directory and all subdirectories.

PowerShell Script Block Collection of Browser Bookmarks via Get-ChildItem

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.