Sigma detection rules, expert-reviewed

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

Windows Process Creation: curl Uploads to File-Sharing Domains

Detects curl commands on Windows uploading files to common file sharing/upload domains.

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Alerts on Windows Python command-line one-liners that import base64 and call decode functions.

Linux Process Execution of Python Base64 Decode One-Liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows

Alerts when PowerShell script blocks reference Exchange inbox/rule cmdlets and forwarding/redirect parameters.

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Suspicious File Creation by OpenEDR ITSMService on Windows

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.

Windows: Suspicious Child Command Execution by SolarWinds WebHelpDesk (WHD)

Alerts on WebHelpDesk (bin) spawning tool-like child processes with download/execution command patterns on Windows.

Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity

Detects PowerShell script content using Exchange cmdlets to create or update inbox rules with message-manipulation actions.

Windows Process Creation: node.exe Running npx skills add New Agent Skills

Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.

Windows: Suspicious Child Process Execution by Notepad++ Updater (gup.exe)

Alerts when Notepad++ gup.exe spawns command/scripting or utility processes using suspicious tool keywords on Windows.

Windows File Creation by Notepad++ Updater gup.exe in Uncommon Locations

Alerts on file creations by Notepad++ updater gup.exe when the destination path is uncommon or not in allowed locations.

Windows DNS Monitoring: gup.exe Queries to Uncommon Domains

Alerts when Notepad++ gup.exe generates DNS queries to domains outside the approved set.