Sigma detection rules, expert-reviewed

Windows regsvr32.exe Silent DLL execution invoking DllRegisterServer from uncommon paths

Alerts on regsvr32.exe /s /e executions of DLLs from potentially suspicious locations that may trigger DllRegisterServer.

DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)

Alerts on AutoIt3.exe execution when spawned from cmd.exe, KeyScramblerLogon.exe, or msiexec.exe, excluding common legitimate install paths.

Windows Autoit3.exe Created by Uncommon Process (curl.exe/KeyScramblerLogon.exe/etc.)

Alerts on Windows events where Autoit3.exe is created, with the producing process matching curl.exe or other uncommon executables.

Windows Process Creation: CoercedPotato.exe Execution via ExploitId Parameters

Flags Windows process creation for CoercedPotato.exe with --exploitId and known IMPHASH values.

Windows Named Pipe Creation with "\coerced\" PipeName Segment

Detects Windows named pipe creations where the pipe name contains the '\coerced\' pattern.

Windows MSSQL Failed Logon (EventID 18456) From External Client IP

Alerts on MSSQL failed login attempts (Event 18456) from client IPs outside typical local/private ranges.

Windows MSSQL Failed Logon (Event ID 18456) Detection

Alerts on MSSQL-related failed login attempts (Event ID 18456) captured in Windows application logs.

O365 Mail Forwarding and Redirecting Rule Changes

Identifies O365 mailbox/inbox rule changes that configure forwarding or redirects in audit logs.

Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe

Alerts on FoxitPDFReader.exe creating .hta files in the Startup Programs folder, which can indicate persistence.

Windows ScreenConnect RMM System Command Execution via cmd.exe

Flags cmd.exe launched by ScreenConnect.ClientService.exe with a TEMP\ScreenConnect command-line path.

Windows: ScreenConnect Temporary File Creation in ConnectWiseControl Temp

Flags file writes to ScreenConnect’s ConnectWiseControl\Temp staging directory from ScreenConnect.WindowsClient.exe.

Windows Application: ScreenConnect RMM File Transfer Activity (Event 201)

Flags ScreenConnect RMM file transfer events on Windows based on provider name, Event ID 201, and transfer action text.

Windows ScreenConnect Remote Command Execution (EventID 200)

Detects ScreenConnect command execution on Windows by matching EventID 200 with an 'Executed command of length' message.

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Flags Windows CLI commands referencing the NTFS ::$index_allocation stream for potential hidden directory activity.

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Alerts on Windows file events creating hidden NTFS content using the '::$index_allocation' alternate stream.