Sigma detection rules, expert-reviewed

Windows Process Creation: Sysmon.exe as Parent of Spawned Process

Alerts when Sysmon.exe/Sysmon64.exe is the parent of a new process, a potentially suspicious execution chain on Windows.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).

Windows System: Kerberos KDC RC4-HMAC downgrade exploit attempts (CVE-2022-37966)

Identifies Windows Kerberos KDC error events tied to RC4-HMAC downgrade/auth negotiation exploitation behavior (CVE-2022-37966).

Windows AppCmd Password Listing Activity via IIS Service Credentials Exposure

Flags appcmd.exe executions that include password-related listing parameters for IIS service account credentials.

Windows File Creation: Suspicious LNK Double-Extension Targeted by Document/Image Prefixes

Alerts on Windows-created filenames that end in .lnk while containing hidden-looking double extensions (e.g., .doc. .pdf.)

Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Identifies Windows successful logons consistent with potential access token impersonation using Advapi and Negotiate.

Windows process creation: suspicious ping wait followed by del file deletion

Flags cmd/powershell command lines that use ping -n with Nul redirection followed by Del /f /q to delete a file.

Windows Executable Initiating Connections to ngrok Tunnel Domains

Flags Windows network connections to ngrok tunnel subdomains that may indicate tunneling for C2 or staging.

Linux network connections to ngrok tunneling endpoints

Alerts on Linux connections to ngrok tunnel domains, which may indicate tunneling-based C2 or exfiltration.

Windows: Detect kavremover-related LOLBIN command-line usage

Alerts on Windows process executions with 'run run-cmd' using kavremover/cleanapi-style LOLBIN invocation patterns.

Windows Scheduled Task Creation with GUID-like Task Name

Alerts on schtasks.exe creating scheduled tasks whose /TN value is wrapped GUID-like braces.

Windows Image Load: Uncommon VSSAPI DLL (vssapi.dll) by Suspicious Executables

Alerts when uncommon processes load vssapi.dll, a Shadow Copy–related DLL, using image load telemetry with path-based exclusions.

Windows Remote Utilities Host Service Installation via Service Control Manager (EventID 7045)

Alerts on Windows Event 7045 when a "Remote Utilities - Host" service is installed from rutserv.exe -service.

Windows Service Installation via NetSupport Manager (Event ID 7045)

Flags Windows service creation for NetSupport Manager Client32 (client32.exe) using Service Control Manager Event ID 7045.

Windows: vsls-agent.exe Executed With --agentExtensionPath Suspicious Library Load

Flags vsls-agent.exe launched with --agentExtensionPath, suggesting a potentially suspicious external extension/library load.