Sigma detection rules, expert-reviewed

Windows Process Creation Attempt Using wmic.exe process call create

Alerts on Windows process creation attempts invoking wmic.exe with “process call create”, a common pattern for WMI-based execution.

Windows Suspicious Child Processes Spawned by Web Server Executables

Alerts when web server processes (e.g., nginx/httpd/caddy/php/tomcat) spawn suspicious Windows command/scripting executables.

Windows Process Execution From Uncommon or Sensitive Directories

Alerts on process executions from uncommon/sensitive Windows directories, excluding specific IBM and Citrix updater paths.

Windows Shim Database Persistence via sdbinst.exe with .sdb Payload

Alerts when sdbinst.exe runs and references a .sdb shim database, indicating potential shim-based persistence.

Windows schtasks.exe Scheduled Task Creation by Non-Microsoft Office Integration

Alerts on schtasks.exe /create executions indicating scheduled task creation, with exclusions for Office integrator-related cases.

Windows Process Creation: Suspicious rundll32 Command-Line Invocations of Common DLL Entry Points

Detects rundll32 runs whose command lines reference specific DLL exports often abused for LOLBIN execution.

Windows Process Execution from Unusual System Locations

Alerts on Windows process launches where the executable path is in or contains unusual directories like RECYCLER or SystemVolumeInformation.

Windows Suspicious rasdial.exe Process Execution

Flags Windows process executions of rasdial.exe by matching process image names ending with rasdial.exe.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

PowerShell Spawned by wscript.exe or cscript.exe on Windows

Flags PowerShell launched by Windows script engines (wscript/cscript), excluding specific Health Service State activity.

Windows PowerShell execution with download-related command line patterns

Alerts when PowerShell is started with command-line fragments indicative of downloading remote content.

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).

Windows Process Reconnaissance via net.exe Group/Account Queries

Alerts on Windows net.exe commands querying groups and accounts via domain/local group and /do-related flags.

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.