Sigma detection rules, expert-reviewed

Windows Successful Local Kerberos Logon to Built-in Administrator (Possible Privilege Escalation)

Alert on successful local (127.0.0.1) Kerberos logons targeting the built-in Administrator SID for potential privilege escalation.

Windows: Detect KrbRelayUp.exe HackTool Process Execution

Flags Windows process executions of KrbRelayUp.exe with relay/domain and SCM spawn command-line patterns.

Windows Sysmon Application Popup Crash (Event ID 26)

Flags Application Popup events reporting sysmon64.exe/sysmon.exe “Application Error” (Event ID 26).

Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path

Alerts on creation of Get-Variable.exe in Local\Microsoft\WindowsApps, a potential cmdlet-path hijack.

Windows Remote Thread Created in KeePass.exe

Flags remote thread creation targeting KeePass.exe, a possible indicator of credential theft.

Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Alerts on cmd/powershell-launched commands referencing findstr, a .vbs script, and a .lnk file—indicative of shortcut-triggered loader activity.

Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access

Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.

Windows process contacting Dropbox API from non-Dropbox executables

Alerts when a non-Dropbox executable makes initiated connections to Dropbox API endpoints on Windows.

Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation

Alerts when 7zFM.exe spawns cmd.exe or PowerShell with command-line patterns consistent with CVE-2022-29072 exploitation attempts.

Windows schtasks.exe scheduled task creation from suspicious folders

Alerts on schtasks.exe /create using PowerShell/cmd and suspicious folder paths like ProgramData.

Windows Network Connections Initiated by Eqnedt32.EXE

Identifies outbound network connections started by eqnedt32.exe on Windows.

Windows RPCSS svchost (-k RPCSS) Process Spawn Anomaly (Potential CVE-2022-26809)

Alerts on svchost.exe running RPCSS spawning anomalous child processes indicative of potential RPC abuse.

Windows File Creation: PowerShell webAdministration Module Path Used in CVE-2022-24527 LPE

Flags Windows file events creating webAdministration.psm1 under PowerShell modules, consistent with CVE-2022-24527 LPE behavior.

Windows Process Creation: SQLite Access to Firefox Profile Databases

Alerts when Windows runs SQLite tooling to query Firefox profile DBs like cookies.sqlite or places.sqlite.

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.