Sigma detection rules, expert-reviewed

Windows: ie4uinit.exe Used from Non-Standard Current Directory

Flags ie4uinit.exe runs whose CurrentDirectory is outside expected system paths, indicating potential LOLBIN misuse.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process

Alerts when macro-enabled Office files are created by common Windows script execution processes.

Windows mpiexec.exe LOLBin: Flag combination with -n/n 1 for potential arbitrary execution

Alerts on Windows executions of mpiexec.exe with /n 1 or -n 1, correlated to a specific imphash, indicating LOLBin-style behavior.

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

Windows manage-bde.wsf via wscript/cscript Proxy Execution

Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.

Windows Process Creation: Flag Renamed Execution of Common LOLBins Based on OriginalFileName

Alerts when a renamed process executes and Sysmon OriginalFileName matches common Windows LOLBins, suggesting defense-evasion rename behavior.

Windows Process Creation: Suspicious rundll32 Command-Line Invocations of Common DLL Entry Points

Detects rundll32 runs whose command lines reference specific DLL exports often abused for LOLBIN execution.