Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious Renamed Binary Masquerading as Common Tools

Flags Windows executions where Sysmon OriginalFileName matches common tools but the process Image name ends differently.

Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Flags Windows 4624 successful logons consistent with Pass-the-Hash activity using NtLmSsp or seclogo.

Webserver URL Enumeration for Exposed .git Paths via GET Keyword

Alerts when web requests include .git/ in the URL, suggesting source code enumeration against version control paths.

Windows Process Creation: Renamed jusched.exe Execution via Java Scheduler Names

Alerts when Java Update Scheduler descriptions are used to execute a process ending with \jusched.exe on Windows.

Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Alerts on Windows failed logon (4625) events matching a BlueKeep scanner PoC TargetUserName value.

Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56

Flags suspicious TermDD RDP error events (Event IDs 50/56) on Windows that may indicate CVE-2019-0708 activity.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change

Flags schtasks.exe executions with /change, /TN, /RU, and /RP, consistent with task modification tied to BearLPE attempts.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths

OceanLotus Registry Activity