Sigma detection rules, expert-reviewed

Windows: Local user account creation via net.exe or net1.exe

Alerts on net.exe/net1.exe launching with "user" and "add" to create local accounts on Windows.

Antivirus Web Shell Signature Matches Across ASP, JSP, PHP, Perl, and VBS

Alerts on AV signatures indicating web shells/backdoors (ASP/JSP/PHP/Perl/VBS/Webshell) to support fast investigation of persistence.

Antivirus alerts for suspicious file paths and web/script file extensions

Alerts on AV hits involving suspicious file locations and web/script-related extensions.

Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)

Triggers on AV signatures matching PWS* or known credential-dumping tool strings indicating potential password theft activity.

Antivirus signature match for exploitation framework indicators

Alerts when AV signature names contain indicators tied to exploitation frameworks and related backdoors.

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Flags PowerShell (powershell.exe/pwsh) process executions with command-line indicators consistent with XOR/obfuscated scripting.

Windows PowerShell Suspicious Encoded Command-Line Execution

Alerts on PowerShell launched with encoded-command switches and embedded encoded content patterns in the command line.

Windows process creation: svchost.exe launched by sllauncher.exe for DLL side-loading

Flags AppData\Roaming-launched svchost.exe instances spawned by sllauncher.exe with -k, matching DLL side-loading execution behavior.

Windows Process in Suspicious Folder Initiating Network Connections to File Sharing Domains

Alerts on outbound connections to file sharing domains from Windows executables running out of suspicious temp/recycle/task paths.

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

Windows Registry Run Key Set to Executable in Suspicious Folder

Flags new Windows Run key values pointing to executables in suspicious folders, excluding known update/Spotify patterns.

Windows Process Creation: PowerShell Command Execution Hidden in DLL Invocation

Flags DLL-invoking Windows binaries whose command lines include PowerShell execution strings.

Windows: .NET Reflection Attempt to Disable AMSI via amsiInitFailed

Alerts on Windows command lines referencing amsiInitFailed and .NET reflection patterns to disable AMSI scanning.

DNS TXT Answers Containing Command Execution Keywords (IEX, Invoke-Expression, cmd.exe)

Alerts on DNS TXT answers containing IEX/Invoke-Expression or cmd.exe strings indicative of execution-oriented payloads.

PowerShell NTFS Alternate Data Stream Writes via set-content/add-content

Alerts on PowerShell Set/Add-Content operations that specify -Stream, indicating potential NTFS Alternate Data Stream writes.