Sigma detection rules, expert-reviewed

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Flags Windows where Windows Defender Firewall is reset to default settings via firewall-as events.

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Alert on Event ID 2009 when the Windows Defender Firewall service cannot load Group Policy.

Windows Firewall exception rule deleted (Windows Firewall/Defender) EventID 2006/2052

Flags deletion of Windows Defender Firewall exception rules using EventID 2006 or 2052 with modifying application context.

Windows Firewall: New Exception List Rule Added (Uncommon Defender Firewall Event 2004/2071/2097)

Alerts on Windows Firewall exception rule additions (Event IDs 2004/2071/2097), excluding common benign paths.

Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)

Flags Windows Defender Firewall exception list changes (Event IDs 2005/2073), indicating potential attacker-driven network access changes.

Windows Process Creation: wlrmdr.exe with -u Flag or Uncommon Child Process Execution

Flags wlrmdr.exe launched with -u or uncommon children spawned with specific flags, using process creation telemetry.

Windows Process Command-Line Dosfuscation Pattern Detection (Potential Obfuscation)

Alerts on Windows command lines containing known dosfuscation-style obfuscation patterns.

Windows: Rundll32 Executing Registered COM Local Servers via Command-Line { }

Flags rundll32.exe launching COM local servers using -sta/-localserver with braced arguments.

Windows Process Creation: ScreenConnect Service Execution

Alerts on Windows executions identified as ScreenConnect service/product/company strings, indicating potential remote access C2 activity.

Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling

Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.

Windows: reg.exe Adds Windows Defender Exclusion Paths via Registry Value Update

Detects reg.exe commands that modify Windows Defender/Microsoft Antimalware exclusion path registry entries.

Windows esentutl.exe Browser Data Collection via -r and WebCache path

Flags esentutl.exe runs with -r and WebCache references, indicating potential browser data collection.

Windows File Creation of ScreenConnect Temporary Installation Artefact

Flags Windows file events referencing temporary ScreenConnect artefacts under the \Bin\ScreenConnect.* path.

GoToAssist Temporary File Drop in Windows Temp Directory

Flags creation of GoToAssist Remote Support Expert temp installation artefacts under Windows AppData\Temp.

Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

Flags schtasks.exe scheduling that triggers PowerShell to decode a base64 payload pulled from Windows Registry.