Sigma detection rules, expert-reviewed

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

Windows Registry: New TaskCache entry created by unusual process image

Alerts when TaskCache registry entries are created by processes other than a defined set of expected Windows binaries.

Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata

Alerts on process creation events consistent with running PurpleSharp.exe on Windows.

Windows process and registry activity matching SOURGUM persistence/privilege escalation behavior

Alerts on Windows process activity referencing specific system/IME WimBoot files and registry 'reg add' changes targeting HKLM CLSID inprocserver32.

Windows: Process writes registry to disable storage write-protection

Alerts on Windows process command lines that appear to disable storage write-protection via registry modification.

Windows Registry Set—Custom Outlook Today Page for Persistence

Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.

Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache

Flags Outlook (outlook.exe) form file activity targeting local FORMS directories often used for persistence.

Windows Registry Changes for Outlook WebView Home Page URL Persistence

Alerts on Windows registry modifications affecting Outlook WebView home page URL settings.

BabyShark HackTool Proxy C2 URL Pattern via momyshark?key=

Alerts on proxy URIs containing the BabyShark agent default "momyshark?key=" query pattern.

Windows Registry: Microsoft Office Protected View Disabled via Security Policy Keys

Flags Windows registry updates that disable Microsoft Office Protected View for attachments, internet files, UNC paths, or unsafe locations.

Windows Process Creation: Exchange Transport Agent Installation via Install-TransportAgent

Flags Windows command-line executions containing Install-TransportAgent, indicating Exchange Transport Agent installation activity.

Windows MSExchange: Failed Transport Agent Installation (Install-TransportAgent)

Alerts on EventID 6 Exchange management events that include "Install-TransportAgent", indicating a failed Transport Agent installation attempt.

Windows MSExchange Transport Agent Installation via Install-TransportAgent

Flags Exchange Transport Agent installation attempts using the Install-TransportAgent command in MSExchange management telemetry.

Windows AMSI Provider Registry Key Deletion (HKLM\Software\Microsoft\AMSI)

Alerts on deletion of AMSI provider registry key entries under HKLM\Software\Microsoft\AMSI, potentially indicating AMSI inspection impairment.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.