Sigma detection rules, expert-reviewed

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.

Windows Security: Network Access to protected_storage (IPC)

Flags Windows network share access to protected_storage through IPC from Security event 5145.

Windows: MMC spawning command-line executables

Flags cases where mmc.exe starts command-line tools like cmd, PowerShell, script hosts, or BITSADMIN.

Windows CMSTP UAC Bypass Attempt via Autoelevate COM Object DllHost Execution

Detects DllHost.exe spawning CMSTP-related autoelevate COM objects by matching known Processid values and high/system integrity.

Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension

Alerts on Windows processes whose paths/command lines use misleading double extensions ending in .exe to cloak executable execution.

Windows Security Event 4662 Detects DPAPI Domain Backup Key Extraction from Domain Controllers

Detects read access to LSA secret DPAPI domain backup key objects in Windows Event ID 4662.

Windows Process Creation: Flag Renamed Execution of Common LOLBins Based on OriginalFileName

Alerts when a renamed process executes and Sysmon OriginalFileName matches common Windows LOLBins, suggesting defense-evasion rename behavior.

Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names

Alerts when Java Update Scheduler descriptions are used to execute a process ending with \jusched.exe on Windows.

Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Alerts on Windows failed logon (4625) events matching a BlueKeep scanner PoC TargetUserName value.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change

Flags schtasks.exe executions with /change, /TN, /RU, and /RP, consistent with task modification tied to BearLPE attempts.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.