Sigma detection rules, expert-reviewed

Windows net.exe Commands Manipulating Built-in Default Accounts (administrator/guest)

Flags net.exe/net1.exe process creation when command lines reference built-in Administrator/guest/default accounts with suspicious active/disable context.

Windows Suspicious cmd.exe Launch After net use Mounting WebDAV Share

Flags cmd.exe command lines that mount an Internet WebDAV share with net use and immediately execute content from DavWWWRoot.

Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)

Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.

Windows Network Connection from Cmstp.EXE (Outbound)

Alerts on outbound network connections initiated by cmstp.exe, which is uncommon and may indicate process misuse.

Windows: cmstp.exe Loading DLL/OCX from Suspicious Paths

Alerts when cmstp.exe loads DLL/OCX from suspicious directories on Windows.

Windows RTCore64 Service Installation via Service Control Manager (Event ID 7045)

Alerts on creation of the RTCore64 Windows service via Service Control Manager Event ID 7045.

Windows SharpLdapWhoami Execution via LDAP Whoami Methods

Flags execution of SharpLdapWhoami on Windows using LDAP-related whoami alternative method parameters.

Windows Process Creation: nimgrab.exe Execution (Nim Tool Download Behavior)

Alerts on execution of nimgrab.exe on Windows when hashes match known indicators.

Windows Network Connections by wscript/cscript Script Interpreters to Non-Local IPs

Flags wscript.exe/cscript.exe making outbound connections to non-local destination IPs.

Windows Scheduled Task Index Registry Tampering Hiding Tasks from Query Tools

Alerts on registry set events that tamper scheduled task TaskCache Tree "Index" DWORD to 0.

Windows Process Execution: Suspicious PowerShell Encoded Command with Exec Bypass

Flags Windows process creations with a bypass-and-encoded PowerShell Start-Job command-line pattern linked to Mercury-related activity.

Windows Service Control Manager detects Sliver C2 default service installations via service creation events

Alerts on Service Control Manager EventID 7045 for Sliver service installations using a known Temp-staged EXE path pattern.

Windows RegistrySet: EulaAccepted set for renamed Sysinternals tools

Flags Windows registry writes to \EulaAccepted for Sysinternals-related objects when performed by non-matching executables.

Windows Registry: Sysinternals Renamed Tool Execution Indicator via EulaAccepted Key

Flags registry writes to EulaAccepted for Sysinternals-named targets when executed by non-matching image filenames.

Windows msdt.exe Creating Files in Common Startup and Public Directories

Alerts when msdt.exe writes files to high-suspicion directories that may indicate persistence after exploitation.