Every published rule

Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text

Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Identifies uncommon setres.exe children matching '\choice' while excluding System32/SysWOW64 choice.exe.

Windows Privilege Escalation via mklink Symlink Between cmd.exe and osk.exe

Alerts on mklink creating a symlink between osk.exe and cmd.exe, enabling potential login-screen privilege escalation.

Windows Image Load of Specific System DLLs Not Normally Present in System Directories

Alerts on image load events for specific system-path DLLs with unexpected “phantom” DLL names on Windows.

Windows Registry: LSASS Full Dump via WER LocalDumps DumpType=2

Flags registry changes enabling LSASS full memory dumps by setting WER LocalDumps DumpType to 0x2.

Windows: LSASS Dump (.dmp) Files in CrashDumps Folder

Alerts when an lsass.exe dump (.dmp) appears in the Windows CrashDumps directory under systemprofile.

Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)

Alerts on Application Error (Event ID 1000) entries where lsass.exe crashes, using Windows Application event telemetry.

Windows windefend alerts on suspicious Windows Defender configuration changes (Disable* and SpyNet reporting)

Alerts on windefend Event 5007 when Defender configuration changes set features like anti-spyware, scanning, or SpyNet reporting to disabled values.

Windows Windefend: Defender Restored File from Quarantine (EventID 1009)

Alerts on Windows Defender Windefend events indicating an item was restored from quarantine (Event ID 1009).

Windows Process Creation: Command Line Contains Emoji Characters

Alerts on Windows process executions whose command line includes emoji/symbol characters from a predefined list.

Windows Process Command Line Contains Emoji Characters

Alerts when a Windows process command line includes emoji characters, which can be used to obscure activity or bypass naive detections.

Windows Process Creation: Command Line Contains Specific Emoji Characters

Alerts when a Windows process command line includes specific emoji Unicode characters that may be used for evasion or obfuscation.

Windows Process Creation Command-Line Contains Emoji Characters

Alerts on Windows executions whose command line includes emoji Unicode characters.

Windows Process Creation: Renamed Mavinject32/64.EXE Execution

Alerts on renamed executions of mavinject32.exe/mavinject64.exe based on OriginalFileName and image path.

Windows Security: Suspicious Scheduled Task Update via Event ID 4702 Keywords

Alerts when a scheduled task is updated (EventID 4702) and the new task content includes suspicious execution keywords or temp/user paths.

Windows Security Audit: Scheduled Task Deleted or Disabled (Important Task Names)

Alerts on deletion or disabling of important Windows scheduled tasks based on Security audit events 4699 and 4701.

Windows Security: Suspicious Scheduled Task Creation via Event 4698

Alerts on Windows scheduled task creation (EventID 4698) when TaskContent contains suspicious directories or command patterns.

Windows Process Execution of wsudo with System or TrustedInstaller

Alerts on wsudo.exe runs from wsudo-bridge.exe requesting execution as System or TrustedInstaller.

Windows DLL Sideloading via Loading ShellChromeAPI.dll

Alerts when Windows processes attempt to load ShellChromeAPI.dll, a DLL typically not present on systems.

Windows: Gpg4win (GnuPG) Encrypt/Decrypt Command Using Suspicious File Paths

Flags Gpg4win/GnuPG file crypto commands using -passphrase with activity in temporary/public or suspicious Windows directories.