Sigma detection rules, expert-reviewed

Windows Registry: Suspicious Keyboard Layout Preload in User Session

Detects user-hive registry changes that preload Persian (Iranian) or Vietnamese keyboard layouts under Windows.

Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution

Flags psr.exe launched with /start or -start, indicating potential user screen and click recording.

Windows OpenWith.exe Launches Another Binary via /c

Flags Windows OpenWith.exe executions that include '/c', indicating it launched another binary.

Windows Devtoolslauncher.exe LaunchForDeploy Executes a Specified Binary

Alerts when devtoolslauncher.exe runs with LaunchForDeploy, indicating it may launch another binary on Windows.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows regsvr32 DLLLoad from AppData Local containing DllEntry

Alerts when regsvr32 loads a DLL from AppData\Local with a DllEntry reference.

Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders

Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).

Windows Process Activity Indicative of QBot (WinRAR to wscript, ping/type, regsvr32)

Alerts on Windows process creation consistent with QBot-like script execution chains from WinRAR and regsvr32/tmp staging.

Windows Formbook-style process execution deleting dropped payloads from AppData Temp via cmd

Flags Windows process creation where an .exe runs deletion commands to remove dropper artifacts from AppData Temp/Desktop.

Windows Process Creation: Emotet-like Command-Line Patterns

Alerts on Windows process executions with command-line indicators consistent with Emotet-like staging and encoded payload usage.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.