Sigma detection rules, expert-reviewed

Windows vmnat.exe Renamed Execution for Possible DLL Side-Loading

Alerts on Windows processes where vmnat.exe appears renamed, which may support stealthy execution and DLL side-loading behavior.

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.

Windows node.exe Execution with -e/--eval and suspicious child process usage

Alerts on node.exe started with -e/--eval and command-line indicators of child_process and net.socket connect activity.

Windows Security: Suspicious SAMTHEADMIN-* Computer/Account Names Ending with $

Alerts on Windows Security events with computer account names starting SAMTHEADMIN- and ending with $.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Process Creation: SharpEvtMute Execution (Event Log Tampering)

Alerts on SharpEvtMute.exe runs with event-log filter and encoded command-line parameters on Windows.

Windows SysmonEnte Process Access Attempt (Sysmon.exe/ Sysmon64.exe/ Sysmon64a.exe)

Flags attempts to access Sysmon binaries consistent with SysmonEnte execution based on TargetImage, GrantedAccess, and CallTrace.

Windows: Detect EvtMuteHook.dll Load by IMPHASH Match (SharpEvtMute)

Detects DLL loads with a specific IMPHASH consistent with EvtMuteHook.dll used for event log tampering.

Windows suspicious file download URLs using direct IP address with script/binary extensions

Alerts on Windows downloads from HTTP/HTTPS direct IP URLs targeting script/binary/shortcut-like filenames.

Windows Process Creation: WinAPI Function Names in Command-Line

Alerts on Windows processes whose command lines reference WinAPI functions/modules commonly used for dynamic invocation and memory/process manipulation.

Windows Process Creation: Renamed Sysinternals Sdelete Execution

Alerts on Windows processes created with OriginalFileName sdelete.exe but executed via renamed sdelete binary paths.

Windows PowerShell DNS TXT Download Cradle via nslookup (Process Creation)

Flags PowerShell spawning nslookup configured to query DNS TXT records as a download cradle.

Windows SharpChisel Command-Line Execution via SharpChisel.exe

Alerts on Windows process executions where the SharpChisel executable or Product metadata indicates SharpChisel.