Sigma detection rules, expert-reviewed

Suspicious wuauclt.exe Process Creation on Windows with Empty Command-Line Flags

Alert on Windows Update Agent wuauclt.exe launches that have command lines ending with no flags/arguments.

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Alerts on processes launched from \Users\Public that execute common scripting/shell binaries or command-line markers.

Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands

Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.

Windows process creation: CrackMapExec execution via characteristic command-line flags

Alerts on Windows process creation showing CrackMapExec-style command-line flags for local auth and module execution.

Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload

Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.

Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns

Flags Windows process creation with wiper-like PowerShell comsvcs MiniDump and related command-line/paths.

Windows Process Command-Line Indicators of BlackByte Ransomware Activity

Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.

Windows Registry: Disable CrashDump via CrashControl DWORD value

Alerts on registry changes that disable Windows crash dumps by writing 0x00000000 to CrashControl.

Windows Scheduled Task Creation via schtasks with Suspicious Command-Line Patterns

Flags schtasks.exe /Create commands containing suspicious interpreter, encoding, hidden execution, or unusual path/script components.

Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior

Alerts on explorer.exe executions that include /NOUACCHECK, indicating potential bypass of UAC checks for child processes.

Windows scheduled task creation via schtasks.exe from suspicious parent path

Flags schtasks.exe /Create when spawned from temp or user-writable parent directories on Windows.

Windows Schtasks.exe Task Creation Targeting Suspicious Paths or Env Variables

Alerts when schtasks.exe creates tasks whose target path/arguments reference suspicious folders or common environment variables.

Windows CHCP Console Code Page Lookup Triggered From cmd.exe

Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.

Suspicious Reset-ComputerMachinePassword Usage via PowerShell on Windows

Detects PowerShell executions of Reset-ComputerMachinePassword that may indicate attempts to alter domain computer account authentication.

Windows Process Execution of Tor or Tor Browser (tor.exe / Firefox-based)

Flags Windows execution of tor.exe or Tor Browser’s bundled Firefox from the expected installation path.