Sigma detection rules, expert-reviewed

Windows: Detect kavremover-related LOLBIN command-line usage

Alerts on Windows process executions with 'run run-cmd' using kavremover/cleanapi-style LOLBIN invocation patterns.

Windows Image Load: Uncommon VSSAPI DLL (vssapi.dll) by Suspicious Executables

Alerts when uncommon processes load vssapi.dll, a Shadow Copy–related DLL, using image load telemetry with path-based exclusions.

Windows Process Command Lines Referencing Dot-Suffixed File Names

Alerts on Windows process executions whose command lines reference file-path strings ending with a dot.

Windows Exchange PowerShell Cmdlet History File Deleted

Flags deletion of Exchange PowerShell cmdlet history log files in the expected logging directory.

Windows: Registry change disabling MacroRuntimeScanScope runtime macro scanning

Flags Office registry updates that set MacroRuntimeScanScope to 0x00000000, disabling runtime scanning for enabled macros.

PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services

Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

PowerShell Set-Acl targeting Windows folder paths on Windows

Flags PowerShell Set-Acl commands that modify ACLs for Windows folder paths, often using FullControl/Allow.

PowerShell Set-Acl Script Execution Changes File or Folder Permissions on Windows

Flags PowerShell commands using Set-Acl (-AclObject and -Path) to alter Windows file or folder permissions.

PowerShell Set-Service SecurityDescriptorSddl DACL Modification for Windows Services

Detects PowerShell Set-Service commands with SecurityDescriptorSddl SDDL patterns that modify Windows service DACLs.

Windows PowerShell Set-Service SDDL Usage to Hide Services

Flags pwsh Set-Service commands that set a SecurityDescriptorSddl to hide a Windows service from other tools.

PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services

Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.

Windows Security Event 5136: msDS-KeyCredentialLink Shadow Credential Added to AD Object

Alerts on AD attribute changes adding to msDS-KeyCredentialLink via Windows Security EventID 5136, consistent with shadow credential additions.

macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging

Flags macOS process creations showing curl+eval execution and intermediate agent indicators associated with WizardUpdate activity.