Sigma detection rules, expert-reviewed

Windows Process Reconnaissance via net.exe Group/Account Queries

Alerts on Windows net.exe commands querying groups and accounts via domain/local group and /do-related flags.

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.

Windows Java Process Started with Remote Debugging Enabled for Non-Localhost Connections

Identifies Java processes started with JDWP dt_socket remote debugging on a non-localhost address.

Windows Cmdkey.EXE Cached Credential Reconnaissance

Alerts on cmdkey.exe running with -l to enumerate cached credentials on a Windows host.

Windows cmd.exe Command Line with URL and %AppData% Indicators

Alerts on cmd.exe executions whose command line includes a URL pattern (http/https) and %AppData%.

Windows Script File Execution via Wscript/Cscript Using Script File Extensions

Flags wscript.exe or cscript.exe executing common script file types via command-line extensions on Windows.

Windows: Process execution from web server root folders (wwwroot, htdocs, wmpub)

Alerts on Windows processes executing from typical web server root folders, consistent with webshell or backdoor staging.

Windows Process Creation: Execution of Net.exe or Net1.exe

Alerts on execution of net.exe/net1.exe with common net subcommands via Windows process creation and command-line telemetry.

Windows Execution of Microsoft.Workflow.Compiler.exe

Flags Windows process executions of Microsoft.Workflow.Compiler.exe, a binary that may be abused for arbitrary unsigned code execution.

Windows process activity matching WannaCry executables and ransom note text

Alerts on Windows process creation where WannaCry-related executables and the @Please_Read_Me@.txt command indicator appear.

Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution

Flags Windows process execution indicative of NotPetya: clearing event logs with wevtutil and deleting C drive USN journal with fsutil.

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

Windows Registry Persistence via UserInitMprLogonScript Value

Detects registry value name containing "UserInitMprLogonScript", which may indicate logon-script persistence setup.

Windows userinit.exe Spawns Uncommon Child Processes

Alerts when userinit.exe starts an unexpected child process during logon, suggesting potential persistence via modified logon behavior.

Windows Command Line Logon Script Persistence via UserInitMprLogonScript

Alerts when a Windows process command line references UserInitMprLogonScript, a potential logon-script persistence indicator.