Sigma detection rules, expert-reviewed

Windows Elevated Shell Execution via LogonId 0x3e7

Flags creation of privileged PowerShell or cmd.exe processes tied to an elevated logon context.

Windows Process Creation: Detect Event Log Query via wmic.exe, wevtutil.exe, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

Windows: Detects Suspicious cmd.exe or PowerShell spawned from Confluence (tomcat) Processes

Alerts when Confluence/embedded Tomcat spawns cmd.exe or PowerShell on Windows, indicating possible command execution after exploitation.

Windows Process Execution for PowerShell Cobalt Strike Download via Hidden IEX

Flags PowerShell command lines that use IEX and hidden downloadstring to fetch a Cobalt Strike payload.

Windows PowerShell script launcher matching SysAidServer Tomcat paths

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

PowerShell Script Evidence Eraser Searching for cleanLL and usersfiles.war

Identifies PowerShell script blocks containing evidence-cleanup indicators and a repeating while(1) loop.

Windows PowerShell Script File Creation: SysAidServer Webapp User/User.exe Indicators

Detects creation of specific SysAidServer Tomcat webapp files indicative of PowerShell script staging on Windows.

Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell

Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.

Windows PowerShell EnableScripts Policy Enabled via Registry DWORD

Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise

Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.

Windows Process Execution Triggered from WebDAV LNK Paths

Alerts on explorer.exe launching cmd/cscript/mshta/powershell/wscript/pwsh when the command line references a WebDAV \DavWWWRoot\ LNK path.

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Windows PowerShell ScriptBlock WinAPI Function Calls

Find PowerShell script blocks that reference WinAPI/native-call function names tied to process, memory, token, or thread operations.