Sigma detection rules, expert-reviewed

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.

Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration

Alerts on schtasks.exe /create executions indicating scheduled task creation, with exclusions for Office integrator-related cases.

Windows Process Creation: Execution of Net.exe or Net1.exe

Alerts on execution of net.exe/net1.exe with common net subcommands via Windows process creation and command-line telemetry.

Windows NTLM authentication events (Event ID 8002)

Alerts on Windows NTLM authentication occurrences based on Event ID 8002 from Microsoft-Windows-NTLM/Operational.

Windows Process Creation with taskmgr.exe as Parent Process

Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.

Windows Security Event 4719 Audit Policy Changes indicate Windows auditing disabled

Flags Windows Event Auditing disabled indicators from Security Event ID 4719 with removed success/failure audit policy.

Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)

Flags USB device plug/unplug related Driver Frameworks User-Mode events using Windows event IDs 2003, 2100, and 2102.

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Alerts when proxy users download common malware and lure file types from hosts using suspicious TLDs.

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

Windows Registry Key Created: Sysinternals EULA Acceptance

Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.

Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

Windows: PsExec Service File Creation via PSEXESVC.exe Written to Disk

Flags Windows file creation of \PSEXESVC.exe, indicating potential PsExec service deployment for remote execution.

Windows Named Pipe Creation for PsExec Default Pipe

Alerts on creation of the default PsExec named pipe (\\PSEXESVC) using Windows named pipe creation telemetry.

Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains

Finds proxy traffic requesting executable or script/doc payloads from hosts with suspicious TLDs not in the whitelist.

Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

Flags outbound network connections initiated by PowerShell on Windows, excluding common local and private IP ranges.