Sigma detection rules, expert-reviewed

Windows Remote Thread Injection Indicators via Process StartAddress Suffixes

Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.

Zeek SMB spoolss Named Pipe (IPC$) Access

Flags Zeek SMB events accessing the spoolss named pipe via IPC$.

Windows Service Control Manager: WerFaultSvc Installed via Service Creation (Event ID 7045)

Alerts on Windows Event 7045 service creation for "WerFaultSvc" as an indicator of dropper-style persistence.

Windows: Suspicious Executable Downloads Missing File Metadata Fields

Alerts when a process launches from Downloads with missing/placeholder file metadata (Description, FileVersion, Product, or Company).

Windows Process Creation—CommandLine Indicators for APT29 2018 Phishing Campaign

Alerts on Windows command-line substrings seen in the 2018 APT29 phishing campaign indicators.

Windows File Events: Detect ds7002*.lnk, .pdf, and .zip Indicators

Flags Windows file events with target filenames containing ds7002.lnk, ds7002.pdf, or ds7002.zip.

Windows PowerShell Base64-encoded shellcode in ScriptBlockText

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

Windows: Potential Kerberoasting SPN Enumeration via setspn.exe

Detects Windows setspn.exe runs with SPN query command-line parameters that may indicate Kerberoasting preparation.

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.

Windows: Local user account creation via net.exe or net1.exe

Alerts on net.exe/net1.exe launching with "user" and "add" to create local accounts on Windows.

Antivirus Web Shell Signature Matches Across ASP, JSP, PHP, Perl, and VBS

Alerts on AV signatures indicating web shells/backdoors (ASP/JSP/PHP/Perl/VBS/Webshell) to support fast investigation of persistence.

Antivirus alerts for suspicious file paths and web/script file extensions

Alerts on AV hits involving suspicious file locations and web/script-related extensions.

Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)

Triggers on AV signatures matching PWS* or known credential-dumping tool strings indicating potential password theft activity.

Antivirus signature match for exploitation framework indicators

Alerts when AV signature names contain indicators tied to exploitation frameworks and related backdoors.

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Flags PowerShell (powershell.exe/pwsh) process executions with command-line indicators consistent with XOR/obfuscated scripting.