Sigma detection rules, expert-reviewed

Windows Process Creation: File/Folder Permission Changes via cacls/icacls/net attrib/takeown

Alerts when Windows permission/ownership changes are attempted using ACL and ownership tools with grant/inheritance-related command-line flags.

Windows Raw Disk Access by Uncommon Process Paths

Alerts on Windows raw disk access by processes from uncommon or suspicious locations.

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.

Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY

Flags reg.exe command lines exporting or saving HKLM registry hives tied to SAM, SYSTEM, and SECURITY.

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.

Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage

Flags Windows processes whose command lines contain Mimikatz names and credential-dumping module/function arguments.

Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS

Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.

Windows Volume Shadow Copy Symlink Creation Using mklink

Flags Windows mklink commands that reference HarddiskVolumeShadowCopy to create symlinks.

Windows: Unsigned DLL/EXE Image Loaded Into lsass.exe

Alerts on image loads into lsass.exe where the loaded image is unsigned.

Windows Static Webshell Indicators via Suspicious File Extension Creation in Web Roots

Alerts on Windows creation of script-like files with webshell extensions in web root directories, excluding common benign temp and XAMPP paths.

Windows Network Share File Transfers Targeting Credential and Memory Dump Paths

Alerts on network share access to credential-related files using Windows Security Event 5145.

Rundll32.exe DLL Export Calls by Ordinal (Windows Process Creation)

Detects rundll32.exe commands that specify DLL exports by ordinal using “.dll #” syntax.

Windows Network Tool Use for Possible Packet Sniffing (tshark/windump)

Alerts on Windows executions of tshark or windump that indicate potential passive network traffic capture.

Windows Local Account Discovery via System Utilities Process Execution

Flags Windows processes that match utilities used to enumerate local user and account information.