Sigma detection rules, expert-reviewed

Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

Windows Suspicious File Creation in AppData Outside Common Subdirectories

Alerts on new .exe/.dll/.ps1/.lnk and other files created under unusual AppData locations outside Local/LocalLow/Roaming.

Windows Defender Exploit Guard Tamper via Controlled Folder Access AllowedApplications or ProtectedFolders Changes

Alerts on Windefend EventID 5007 when Exploit Guard ProtectedFolders or AllowedApplications lists are modified.

Azure Audit Logs: Removal of Privileged Role Eligible Members

Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.

Windows RDP Tunneling Using plink.exe on Local Port 3389

Alert on plink.exe command lines referencing 127.0.0.1:3389 or port 3389, suggesting potential RDP tunneling on Windows.

Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.

Windows Security Mitigations: Unsigned DLL Blocked from User-Writable Paths

Alerts on blocked unsigned DLL loads targeting public, downloads, desktop, or temp directories in Windows Security Mitigations logs.

Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget

Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.

Windows PowerShell Invoke-WebRequest Download to Suspicious Paths

Alert when PowerShell uses Invoke-WebRequest/aliases with download flags and targets suspicious file locations.

Windows: Detect VMwareXferlogs.exe Executed from Non-default Path

Alert on VMwareXferlogs.exe launching from an unexpected directory, a potential DLL sideloading technique on Windows.

Windows mpclient.dll Sideloading via MpCmdRun.exe or NisSrv.exe from Non-Default Paths

Alerts when mpclient.dll is loaded by MpCmdRun.exe or NisSrv.exe outside known Windows Defender directories.

Windows: Potential DLL sideloading via VMwareXferlogs loading glib-2.0.dll from non-standard path

Alerts on VMwareXferlogs.exe loading glib-2.0.dll from outside the default VMware directory.

Windows Code Integrity blocks unsigned DLL loads into MpCmdRun.exe and NisSrv.exe

Flags security-mitigations events where MpCmdRun or NisSrv are prevented from loading unsigned DLLs.

Windows Registry Set to Disable Windows Defender Components

Flags registry changes that turn off Windows Defender protections via Defender and Security Center policy keys.

Windows Registry: Attachment Manager policy tampering via Attachments settings values

Detects registry changes to Windows Attachment Manager policy values that can disable or alter download safety controls.