Sigma detection rules, expert-reviewed

Windows Image Load of PCRE.NET Package Temp Module Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

Windows Processes Creating PCRE.NET Temp Package Files

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.

Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32

Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.

Windows Registry: Detect esentutl.exe activity under VSS service keys

Flags registry changes under VSS service keys when initiated by esentutl.exe, consistent with VSS-related abuse.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

macOS Process Creation: grep 'password' or laZagne Credential Extraction

Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.

macOS Process Execution: dd and truncate used for binary padding

Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.

Windows PowerShell Script Execution via Redirected Input Stream

Flags PowerShell/pwsh executions where the command line includes redirected input ("- <").

Potential Windows Registry Persistence via AppCompatFlags TelemetryController Commands

Flags registry entries under TelemetryController\Command that reference executable/script payloads potentially abusing telemetry for persistence.

Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset

Alerts on sc.exe sdset commands that modify service security descriptors to deny access to critical trustees.

PowerShell command-line obfuscation indicators from special-character patterns (Windows)

Alerts on PowerShell executions whose command lines contain repeated special-character obfuscation patterns.

Windows Process Creation: Cmd Invokes PowerShell via Obfuscated Environment Variable Expansion

Alerts on cmd.exe command lines that use obfuscated environment-variable SET to execute PowerShell.

Windows Process Execution Using Obfuscated CMD to Pipe STDIN into PowerShell

Detects obfuscated cmd executions that launch PowerShell and reference $input/noexit patterns for STDIN-based execution.

PowerShell: Obfuscated invocation via Environment Variables in Script Block

Alerts on PowerShell script blocks launching cmd /c or /r with obfuscated set-and-{n} variable expansion patterns.