Sigma detection rules, expert-reviewed

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)

Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.

Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.

Cisco AAA Command Output Collection: show running/startup-config and archive config

Detects Cisco command strings attempting to collect device configuration via show running/startup/archived config.

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

Windows Image Load: WMI DLLs Loaded by Uncommon Process

Alert on loading of common WMI DLLs by processes outside typical system/.NET paths.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Firewall Rule Accepting Cleartext Protocol Ports

Alerts on firewall-allowed traffic to common service ports that may carry credentials over unencrypted channels.

Cleartext Authentication via Netflow to Common Service Ports

Alerts on Netflow flows to specific service ports that may indicate cleartext protocol use and potential credential exposure.

Qualys: Alert When Firewall Product Is Not Detected on a Host

Alerts when Qualys reports a host missing a detectable firewall product during vulnerability management scanning.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.

Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration

Alerts on schtasks.exe /create executions indicating scheduled task creation, with exclusions for Office integrator-related cases.

Windows Process Creation: Execution of Net.exe or Net1.exe

Alerts on execution of net.exe/net1.exe with common net subcommands via Windows process creation and command-line telemetry.

Windows NTLM authentication events (Event ID 8002)

Alerts on Windows NTLM authentication occurrences based on Event ID 8002 from Microsoft-Windows-NTLM/Operational.