Sigma detection rules, expert-reviewed

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Security Log: Metasploit SMB NTLM Logon (4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.

Webserver Detection of POST Logupload Attempt for VMware View Planner CVE-2021-21978

Alerts on webserver POST requests targeting logupload/logMetaData parameters tied to CVE-2021-21978 probing.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

Windows MMC20 Lateral Movement via MMC.exe -Embedding spawned by svchost.exe

Alerts when svchost.exe launches mmc.exe with “-Embedding”, indicating potential MMC20 COM-based lateral movement.

Windows: Detect Microsoft Exchange CVE-2020-0688 exploitation via Eventlog errors

Identifies Exchange Control Panel error events containing a ViewState parameter consistent with CVE-2020-0688 exploitation attempts.

Webserver Request Matching for CVE-2020-0688 Exploitation Attempt

Alerts when webserver URI queries include /ecp/default.aspx with __VIEWSTATEGENERATOR and __VIEWSTATE consistent with CVE-2020-0688 probing.