Sigma detection rules, expert-reviewed

Uncommon PowerShell HostApplication Values in Windows PowerShell Start Logs

Detects PowerShell classic start events with unusual HostApplication values that may indicate evasion of powershell.exe-focused detections.

Windows CreateRemoteThread with LoadLibraryA likely DLL injection

Alerts on CreateRemoteThread starting LoadLibraryA from kernel32.dll, consistent with DLL injection attempts.

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

Windows Security: Network Access to protected_storage (IPC)

Flags Windows network share access to protected_storage through IPC from Security event 5145.

Windows Security Event 4692 Detecting DPAPI Domain Master Key Backup Attempt

Flags Windows Event ID 4692 indicating an attempt to back up the DPAPI domain master key.

Windows Image Load: WMI DLLs Loaded by Uncommon Process

Alert on loading of common WMI DLLs by processes outside typical system/.NET paths.

Windows: MMC spawning command-line executables

Flags cases where mmc.exe starts command-line tools like cmd, PowerShell, script hosts, or BITSADMIN.

Windows CMSTP UAC Bypass Attempt via Autoelevate COM Object DllHost Execution

Detects DllHost.exe spawning CMSTP-related autoelevate COM objects by matching known Processid values and high/system integrity.

Windows Security: AD object replication attempted by non-machine account (Event ID 4662)

Alerts on AD replication-related object access events where the requester is not a machine account.

Windows regsvr32 Executes DLL with Uncommon Extension in Command Line

Alerts when regsvr32.exe is launched with a DLL extension pattern that is not in the common list.

Windows regsvr32 Usage of /i Without /n Flag

Alerts on regsvr32.exe invocations using /i: without the usually paired /n flag.

Windows: Explorer factory invocation causing process tree break

Alerts on process creation command lines showing explorer.exe factory and /root usage consistent with an explorer-based process tree break.

Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension

Alerts on Windows processes whose paths/command lines use misleading double extensions ending in .exe to cloak executable execution.

Windows Security Log LSASS Access by Non-Computer Account Process

Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.