Sigma detection rules, expert-reviewed

Windows regsvr32 Execution of calc with /s flag

Alerts on regsvr32.exe runs using /s with a command line ending in calc.

Suspicious Windows regsvr32 Command-Line Uses FTP/HTTP to Register Remote Components

Alerts on regsvr32 command lines using /i flags with ftp/http content, consistent with remote DLL registration.

Windows DNS Server: Failed DNS Zone Transfer Requests (Event ID 6004)

Alerts on Windows DNS Server Event ID 6004 indicating a failed DNS zone transfer request for a non-existent or non-authoritative zone.

Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

Alerts when rundll32.exe is started from suspicious parent scripts with a DLL-like path missing the .dll extension.

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.

Windows Registry: New ODBC Driver Registration in Suspicious Path

Alerts when Windows registers a new ODBC driver under the ODBCINST.INI area with details pointing to suspicious filesystem paths.

Windows Registry: New ODBC Driver Registration via ODBCINST.INI

Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.

Windows: Odbcconf.EXE INSTALLDRIVER Use With Missing .dll Target

Flags odbcconf.exe running INSTALLDRIVER when the driver argument lacks a .dll extension.

Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

Windows: Uncommon Child Process Spawned by Odbcconf.EXE

Alert on unusual child processes spawned from odbcconf.exe, which may indicate indirect execution abuse.

Windows Process Execution of Odbcconf.exe with -f Response File Flag

Alerts on Odbcconf.exe being run with -f to load a response file, excluding runonce-driven executions.

Windows Odbcconf.EXE Response File Execution via -f Flag

Flags Windows executions of Odbcconf.EXE using -f to load a .rsp response file.

Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.

Windows: Odbcconf.exe used to register a DLL via REGSVR

Flags odbcconf.exe executions using REGSVR to register a DLL, a regsvr32-equivalent technique often abused by attackers.