Sigma detection rules, expert-reviewed

Windows Script Dropped by Signed Applications and LOLBINs

Detects Windows legitimate/signed executables dropping script files (.ps1, .vbs, .js, etc.) to disk, indicating potential script-based abuse.

Windows Suspicious App and LOLBIN Dropping Executable Files to Disk

Alerts on Windows processes like Office/LOLBINs writing .exe/.dll and other executable-equivalent files to disk.

Windows Executable Dropping Archive Files via Common LOLBINs and Office Apps

Alerts when Office or other specified Windows binaries create archive files like .zip/.rar/.7z/.diagcab/.appx on disk.

Windows: Chromium-Based Browser Launched via Script Host with --load-extension

Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.

Windows OpenConsole LOLBIN Execution via Process Creation

Alerts when OpenConsole.exe runs (outside a specific Windows Terminal path), potentially used to bypass application whitelisting.

Windows: ie4uinit.exe Used from Non-Standard Current Directory

Flags ie4uinit.exe runs whose CurrentDirectory is outside expected system paths, indicating potential LOLBIN misuse.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process

Alerts when macro-enabled Office files are created by common Windows script execution processes.

Windows mpiexec.exe LOLBin: Flag combination with -n/n 1 for potential arbitrary execution

Alerts on Windows executions of mpiexec.exe with /n 1 or -n 1, correlated to a specific imphash, indicating LOLBin-style behavior.

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

Windows manage-bde.wsf via wscript/cscript Proxy Execution

Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.

Windows Process Creation: Flag Renamed Execution of Common LOLBins Based on OriginalFileName

Alerts when a renamed process executes and Sysmon OriginalFileName matches common Windows LOLBins, suggesting defense-evasion rename behavior.

Windows Process Creation: Suspicious rundll32 Command-Line Invocations of Common DLL Entry Points

Detects rundll32 runs whose command lines reference specific DLL exports often abused for LOLBIN execution.