Sigma detection rules, expert-reviewed

Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.

Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download

Alerts on registry settings that redirect OneDrive update URL retrieval from UpdateOfficeConfig for internet downloads.

Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

Alerts when PowerShell command lines contain encoded obfuscation patterns referencing Net.Webclient with anomalous casing.

Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.

Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Binaries Downloading Files via HTTP(S) Potentially Arbitrary Payload

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows IEExec.EXE Download-and-Execute via Process Creation

Flags IEExec.exe executions that reference HTTP/HTTPS URLs for download-and-execute behavior.

Windows Remote Thread Creation via Ttdinject.exe Proxy

Alerts on Windows create-remote-thread events initiated by Ttdinject.exe used as a proxy.

Windows Service Creation for KrbRelayUp (KrbSCM)

Flags creation of the KrbSCM Windows service, a known KrbRelayUp installation artifact.

Windows PowerShell Execution of Obfuscated One-Liner for In-Memory Module Download

Alerts on Windows PowerShell one-liners containing an obfuscated in-memory download/execute pattern from an HTTP URL.

Windows Security Event 5379: Opened Password-Protected ZIP from Outlook Attachment

Flags Windows events where a password-protected ZIP is opened from Outlook Temporary Internet Files.

Windows Security: Password-Protected ZIP Opened with Suspicious Filename Indicators

Alerts when Windows opens password-protected ZIP contents with filenames commonly tied to invoices, orders, payments, and deliveries.