Sigma detection rules, expert-reviewed

Windows: rundll32.exe launched by explorer.exe parent process

Alerts when explorer.exe spawns rundll32.exe with specific command-line characteristics on Windows.

Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1

Alerts on PowerShell being launched with CL_mutexverifiers that proxies additional script execution.

PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions

Alerts on PowerShell command lines that call LoadAssemblyFromPath/LoadAssemblyFromNS in CL_LoadAssembly.ps1 context.

Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows grpconv Utility Execution with Output Option

Alerts on Windows process command lines invoking GrpConv with -o, potentially for .grp conversion or persistence.

Windows Office Applications Downloading Files via HTTP/HTTPS

Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Alerts when Microsoft-Windows-Eventlog reports Event ID 104 for core event log channels, indicating log clearing.

Windows: Process creation of TTDInject.exe (ttdinject.exe) for Time Travel Debugging

Alerts on Windows process creation for ttdinject.exe (TTDInject.EXE), a time travel debugging component.

Windows gpscript.exe Executes Group Policy Logon/Startup Scripts

Flags gpscript.exe running with /logon or /startup, suggestive of Group Policy script execution abuse.

Windows IEExec.EXE Download-and-Execute via Process Creation

Flags IEExec.exe executions that reference HTTP/HTTPS URLs for download-and-execute behavior.

Windows: File Download via CertOC.exe Using -GetCACAPS HTTP

Flags CertOC.exe launched with -GetCACAPS and an http URL, indicating a remote file retrieval attempt.

Windows Remote Thread Creation via Ttdinject.exe Proxy

Alerts on Windows create-remote-thread events initiated by Ttdinject.exe used as a proxy.

Windows Process Creation: reg.exe Adds Winlogon SpecialAccounts Userlist Value 0

Flags reg.exe command lines that add SpecialAccounts Userlist with /d 0 to hide accounts from the logon screen.

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.