Sigma detection rules, expert-reviewed

Windows mshta.exe Process Creation Triggered by Suspicious Command Lines

Alert on mshta.exe launches from suspicious parents and script-like command lines/paths.

PowerShell executes ADRecon.ps1 AD reconnaissance functions and writes ADRecon-Report.xlsx

Detects PowerShell ADRecon reconnaissance script content by matching AD discovery functions and the default ADRecon report output name.

Windows: Suspicious Parent-Serv-U.exe Command-Line Process Spawning

Alerts when Serv-U (\Serv-U.exe) spawns typical command interpreters or execution utilities on Windows.

Windows reg.exe Used to Modify Security Service Start Parameters

Flags reg.exe registry changes that target Start parameters for common security and Windows Defender-related services.

Windows PowerShell: AtomicTestHarness Invoke-ATHRemoteFXvGPUDisablementCommand Abuse

Alerts on Windows process command lines invoking AtomicTestHarnesses RemoteFXvGPUDisablement PowerShell execution.

Windows PowerShell Module Creation With RemoteFXvGPUDisablement ModuleContents

Flags PowerShell module creation where ModuleContents includes Get-VMRemoteFXPhysicalVideoAdapter.

Windows PowerShell ModuleContents Set to Get-VMRemoteFXPhysicalVideoAdapter

Alerts on PowerShell module creation embedding Get-VMRemoteFXPhysicalVideoAdapter, a potential precursor to RemoteFXvGPUDisablement.exe abuse.

Windows Uninstall CrowdStrike Falcon Sensor via WindowsSensor.exe /uninstall /quiet

Flags Windows processes uninstalling CrowdStrike Falcon Sensor using WindowsSensor.exe with /uninstall and /quiet.

Windows Process Injection via Mavinject Using INJECTRUNNING Flag

Alerts on Windows process creation using Mavinject with /INJECTRUNNING, indicative of DLL injection into a running process.

Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.

Windows Process Creation: MpCmdRun.exe Removing All Windows Defender Definitions

Flags MpCmdRun.exe launched to remove all Windows Defender definition files.

Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings

Flags Defender tamper protection blocks to disable key Microsoft Defender Antivirus and real-time protection settings.

Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)

Alerts when spoolsv.exe deletes a DLL from the Spooler driver folder path on Windows.

Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation

Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.