Sigma detection rules, expert-reviewed

Windows Security 4663: Access to Microsoft Teams token and local storage files

Identifies non-Teams.exe processes accessing Microsoft Teams cookies or local storage objects on Windows (Event 4663).

Windows: SharPersist Execution via Process Image and Scheduled Task/Startup/Registry/Service Command Lines

Detects SharPersist execution on Windows via process name and persistence-related command-line parameters.

Windows: Service Created by System Using Client with PID 0 (SCM Event 7045)

Alerts on Windows service installation events (SCM EventID 7045) where the client process ID is 0.

Windows Service Created by Client With PID 0 or Parent PID 0

Alerts on Windows service installs (EID 4697) where the client or parent PID is 0.

Windows UAC Bypass via Elevated COM interface using ICMLuaUtil

Flags dllhost.exe parent launches tied to elevated COM /Processid GUIDs consistent with UAC bypass behavior on Windows.

Windows: Taskkill used to terminate ccSvcHst.exe (Symantec Endpoint Protection service impairment)

Flags Windows taskkill /F /IM ccSvcHst.exe executions that can disable Symantec Endpoint Protection services.

Windows Process Creation: Chisel Tunneling Tool (chisel.exe) Execution

Flags Windows executions of chisel.exe with client/server tunneling and SOCKS5 reverse arguments.

Windows Process Creation: 3proxy Proxy Server Execution

Detects execution of 3proxy.exe with local 127.0.0.1 proxy binding on Windows.

PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features

Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.

Windows Schtasks.exe Scheduled Task Creation or Modification with Suspicious Schedule Types

Alerts on schtasks.exe commands that schedule tasks using ONLOGON/ONSTART/ONCE/ONIDLE with potentially malicious privilege context.

Windows schtasks Delete All Scheduled Tasks via /tn * /delete /f

Flags schtasks.exe commands that forcibly delete all scheduled tasks on the local host using /delete /tn * /f.

Windows schtasks.exe Used to Delete Scheduled Tasks for System and Security Components

Alerts when schtasks.exe runs with /delete targeting sensitive Windows scheduled tasks that support security, updates, or recovery.

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.