Sigma detection rules, expert-reviewed

Windows Process Creation with taskmgr.exe as Parent Process

Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.

Windows Security Event 4719 Audit Policy Changes indicate Windows auditing disabled

Flags Windows Event Auditing disabled indicators from Security Event ID 4719 with removed success/failure audit policy.

Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)

Flags USB device plug/unplug related Driver Frameworks User-Mode events using Windows event IDs 2003, 2100, and 2102.

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Alerts when proxy users download common malware and lure file types from hosts using suspicious TLDs.

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

Windows Registry Key Created: Sysinternals EULA Acceptance

Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.

Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

Windows: PsExec Service File Creation via PSEXESVC.exe Written to Disk

Flags Windows file creation of \PSEXESVC.exe, indicating potential PsExec service deployment for remote execution.

Windows Named Pipe Creation for PsExec Default Pipe

Alerts on creation of the default PsExec named pipe (\\PSEXESVC) using Windows named pipe creation telemetry.

Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains

Finds proxy traffic requesting executable or script/doc payloads from hosts with suspicious TLDs not in the whitelist.

Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

Flags outbound network connections initiated by PowerShell on Windows, excluding common local and private IP ranges.

PowerShell Net.WebClient DownloadFile/DownloadString Usage (Classic)

Flags PowerShell Classic commands using Net.WebClient to download content via DownloadFile or DownloadString.

Windows: Detects Access to ADMIN$ Network Share (Event 5140)

Alerts on Windows Security event 5140 entries where an access request targets the ADMIN$ share.