Sigma detection rules, expert-reviewed

Windows Security: Remote DCOM IE DLL Hijack via iertutil.dll in Internet Explorer path

Flags network file writes of iertutil.dll under IE’s Program Files path associated with potential DCOM DLL hijacking.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

PowerShell Script Obfuscation Triggered by Use of clip.exe and Clipboard Invocation

Flags PowerShell Script Block Logging containing clip.exe/clipboard chaining and clipboard-driven execution markers.

PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows System: mshta Launches vbscript:createobject via Service Control Manager (Event ID 7045)

Flags Windows service creation (7045) where ImagePath includes mshta and vbscript:createobject.

Windows System: Suspicious Clip.exe Execution via Service Control Manager (Event ID 7045)

Alerts on Windows service creation starting clipboard/Clip.exe-related binaries via Service Control Manager ImagePath.

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.

Windows Security EID 4697: mshta Used to Run Obfuscated VBScript PowerShell

Detects service creation where the binary path includes mshta plus VBS/automation indicators consistent with script-based obfuscation.

Windows Security 4697: Obfuscated PowerShell via use of Clip.exe from scripts

Alerts on EID 4697 service installations where the service file name matches Clip/clipboard indicators tied to obfuscated PowerShell.

Windows Process Execution: Obfuscated PowerShell Invocation Using mshta with VBScript CreateObject

Flags Windows process command lines containing an obfuscated PowerShell+MSHTA VBScript execution pattern.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.