Sigma detection rules, expert-reviewed

Windows Process Execution of Hashcat.exe for Password Cracking

Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.

Windows: Findstr searches GPP cpassword in SYSVOL XML

Alerts when Windows findstr/find searches SYSVOL XML files for GPP cpassword.

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Copies a DLL into System32 or SysWOW64

Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.

Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks

Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.

Windows: cipher.exe Overwrites Deleted Data Using /w

Flags Windows cipher.exe runs with /w: to overwrite deleted data on disk.

Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo

Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.

Windows Process Termination via taskkill.exe Execution

Alerts on taskkill.exe executions that use /f along with /im or /pid to force-terminate targeted processes.

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

Java keytool Spawns System Shells or Scripting Utilities on Windows

Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.

Windows: Detect Computer Account Rename to Non-Standard Name Missing Trailing '$'

Alerts on Windows 4781 computer account renames where the new name lacks the '$' suffix.

Proxy requests with URI ending in .class extension

Flags proxy requests whose URI path ends with .class, useful for identifying potential Java class downloads.

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Alerts on Windows process executions using filenames that match common Sysinternals tools to indicate potential binary impersonation.

Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

Flags SYSTEM-context process executions on Windows that include suspicious tool names or command-line patterns such as PowerShell/Mimikatz indicators.