Sigma detection rules, expert-reviewed

Windows WFP Event 5156: RDP traffic via loopback when hosted by svchost termsvcs

Flags Windows EventID 5156 where svchost RDP (3389) traffic targets loopback addresses, suggesting tunneled local RDP usage.

Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path

Alerts on Windows registry key additions matching a Ursnif-associated TargetObject path.

Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

Windows Process Creation: Suspicious calc.exe Command-Line Usage Outside System Locations

Alerts on suspicious calc.exe launches via command-line parameters or execution from non-standard Windows directories.

Windows Process Creation: Suspicious GUP.exe Execution from Non-Notepad++ Directories

Alerts on GUP.exe executions from unexpected directories on Windows, excluding known Notepad++ updater paths.

Windows Remote Thread Creation via CACTUSTORCH Using Script/Office/Rundll Host Images

Alerts on SysWOW64 remote thread creation initiated by script host or Office binaries consistent with CACTUSTORCH behavior.

Chafer malware C2 URLs with /asp.asp?ui= pattern over HTTP proxy

Flags proxy HTTP requests containing the C2 URI pattern /asp.asp?ui= associated with Chafer behavior.

Windows netsh.exe Used to Create RDP (3389) Port Forwarding

Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.

Windows RDP Logon Using Localhost IP Address

Alerts on successful Windows logons (EventID 4624, LogonType 10) originating from localhost IPs.

Windows Registry: New Security Support Provider (SSP) added to LSA configuration

Alerts when a new SSP is added to LSA Security Packages in the Windows registry, excluding msiexec-driven changes.

Windows Suspicious Child Processes Spawned by Web Server Executables

Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.

Windows Process Execution From Uncommon or Sensitive Directories

Alerts on process executions from uncommon/sensitive Windows directories, excluding specific IBM and Citrix updater paths.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.