Sigma detection rules, expert-reviewed

Cleartext Authentication via Netflow to Common Service Ports

Alerts on Netflow flows to specific service ports that may indicate cleartext protocol use and potential credential exposure.

Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process

Alerts on .sch cache file creation in the Windows SchCache directory by uncommon executables.

Windows Security Event 5136: Suspicious LDAP attribute display names used

Alerts on Event 5136 containing specific LDAP display names indicative of LDAP-based data exchange.

Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

Qualys: Alert When Firewall Product Is Not Detected on a Host

Alerts when Qualys reports a host missing a detectable firewall product during vulnerability management scanning.

Microsoft BITS Proxy Requests to Uncommon Top-Level Domains

Flags Microsoft BITS-initiated proxy requests to domains using uncommon TLDs.

Windows Process CommandLine contains -export dll_u (DLL export function load)

Flags Windows processes that invoke a DLL export function named dll_u via command-line export arguments.

Windows Security: ScheduledDefrag Task Deactivated via Event ID 4701

Flags Windows EventID 4701 activity that disables the ScheduledDefrag scheduled task.

Windows ScheduledDefrag task removal via schtasks /delete and /change

Detects schtasks.exe commands that delete or change the ScheduledDefrag scheduled task.

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows mshta.exe Execution Using Non-HTA File Extensions

Alerts on mshta.exe launched with command-line indicators for suspicious non-HTA file types and VBScript.

Windows: RDP Session Startup Folder Backdoor via tsclient Share Targeting Startup Path

Flags mstsc.exe activity writing to the Windows Startup folder, indicating potential RDP session backdoor placement.

Windows svchost RDP via Reverse SSH Loopback Tunnel to 127.0.0.0/8:3389

Flags svchost.exe opening RDP (TCP 3389) connections to loopback, consistent with tunneled reverse access behavior.