Sigma detection rules, expert-reviewed

Windows whoami.exe Execution from Suspicious Parent Processes

Alerts on whoami.exe runs where the parent process is not a typical shell or monitoring agent.

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

Windows Process Creation with taskmgr.exe as Parent Process

Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.

Windows svchost.exe Spawned by Uncommon Parent Process

Alerts when svchost.exe starts with an unusual parent process name on Windows.