Sigma detection rules, expert-reviewed

Windows Execution of Microsoft.Workflow.Compiler.exe

Flags Windows process executions of Microsoft.Workflow.Compiler.exe, a binary that may be abused for arbitrary unsigned code execution.

Windows process activity matching WannaCry executables and ransom note text

Alerts on Windows process creation where WannaCry-related executables and the @Please_Read_Me@.txt command indicator appear.

Windows: NotPetya indicators via wevtutil log clearing, fsutil deletejournal, and rundll32 .dat/.zip.dll execution

Flags Windows process execution indicative of NotPetya: clearing event logs with wevtutil and deleting C drive USN journal with fsutil.

Windows WMI Event Subscription Creation (Sysmon Event 19/20/21)

Flags Sysmon-reported WMI event subscription filter/consumer activity (Event IDs 19–21) indicative of persistence.

Windows Registry Persistence via UserInitMprLogonScript Value

Detects registry value name containing "UserInitMprLogonScript", which may indicate logon-script persistence setup.

Windows userinit.exe Spawns Uncommon Child Processes

Alerts when userinit.exe starts an unexpected child process during logon, suggesting potential persistence via modified logon behavior.

Windows Command Line Logon Script Persistence via UserInitMprLogonScript

Alerts when a Windows process command line references UserInitMprLogonScript, a potential logon-script persistence indicator.

Windows Process Creation: Potential Dridex-Related Execution via svchost/regsvr32 and Recon Tools

Alerts on suspicious svchost.exe or regsvr32.exe process executions with matching command-line and parent/child patterns indicative of Dridex activity.

PowerShell Executed From AppData on Windows (Command Line Indicators)

Flags PowerShell command lines that include AppData paths (Local/Roaming), indicating possible user-profile script execution.

Windows Process Creation: Outlook EnableUnsafeClientMailRules Security Setting Enabled

Flags Windows process command lines that reference Outlook’s EnableUnsafeClientMailRules security setting.

Windows Process Creation: SecurityXploded PasswordDump.exe Execution

Alerts on Windows executions of SecurityXploded PasswordDump.exe based on process metadata and filename.

Windows Process Creation: Rubeus HackTool Execution Indicators

Flags Windows process executions of Rubeus.exe when command lines include Kerberos attack-related actions.

Windows Process Creation: Command Line Obfuscation via Escape Characters

Identifies Windows process command lines containing escape-character URL obfuscation patterns.

Windows Remote Thread Injection Indicators via Process StartAddress Suffixes

Flags Windows CreateRemoteThread events with StartAddress suffixes 0B80, 0C7C, or 0C88.

Zeek SMB spoolss Named Pipe (IPC$) Access

Flags Zeek SMB events accessing the spoolss named pipe via IPC$.