Sigma detection rules, expert-reviewed

Windows PowerShell Get-Clipboard Command Execution

Flags PowerShell activity that includes the Get-Clipboard command, which may be used to collect clipboard contents.

PowerShell Decompress via Expand-Archive

Alerts on PowerShell usage of Expand-Archive, a common decompression step attackers may use to unpack files.

Windows Startup Directory File Writes for Persistence

Alerts on file writes into the Windows Startup folder that may indicate user-level persistence.

Windows File Deletion Using Sysinternals SDelete (SDelete rename suffixes)

Flags Windows file deletions targeting filenames ending in .AAA or .ZZZ consistent with SDelete-style artifact removal.

Zeek: Detect WebDAV User-Agent with HTTP PUT to local or RFC1918 addresses

Flags Zeek HTTP PUT requests with a WebDAV User-Agent that target non-excluded network addresses.

Windows Image Load of System.Drawing.ni.dll

Alerts when a Windows process loads System.Drawing.ni.dll, which may indicate visual data collection activity.

Windows PFX File Creation From File Events

Flags Windows file events where a .pfx (certificate + private key) is created, excluding a few common benign locations.

Windows findstr Launches .lnk via Command Line

Flags find.exe or findstr.exe processes whose command lines end with a .lnk file.

WebDAV Delivery of Executable Files over HTTP (Zeek)

Flags Zeek HTTP events where WebDAV traffic serves an .exe with MIME type 'dosexec'.

Windows winget Installs Applications Using Local Manifest File

Flags winget.exe install commands that specify a local manifest file via -m/--manifest.

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Flags Windows command lines that create or copy files into C:\Windows\Fonts\ using suspicious file extensions.

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Detects netsh.exe command-line activity targeting WLAN and clearing keys, indicative of potential WiFi credential harvesting on Windows.

Windows: Process Execution of Suspicious hxtsr.exe (Outside WindowsApps)

Alerts when hxtsr.exe runs from a non-expected WindowsApps Microsoft.WindowsCommunicationsApps location.

AWS CloudTrail EC2 CreateInstanceExportTask Failure

Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.

Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)

Alerts on proxy requests to URIs containing '/pwndrop/', consistent with PwnDrp-style web delivery.