Sigma detection rules, expert-reviewed

Windows SyncAppvPublishingServer Execution Triggering PowerShell Module Context

Alerts when SyncAppvPublishingServer.exe appears in PowerShell module ContextInfo on Windows.

Windows Security: Suspicious Remote Logon Using Explicit Credentials via Command-Line Tools

Flags EventID 4648 remote logons initiated by cmd/PowerShell/winrs/wmic/net/reg-style processes using explicit credentials.

Linux Certificate Store Update: Installing Root Certificates via ca-certificates Commands

Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Alerts when wsl.exe is launched with execution-focused options that may enable arbitrary Linux/Windows command execution.

Windows Process Proxying: explorer.exe Spawned from cmd.exe or PowerShell

Flags cmd.exe/powershell.exe launching explorer.exe, indicating possible proxy-based execution on Windows.

Windows: Manual persistence attempt using schtasks to run Microsoft Compatibility Appraiser

Alerts when schtasks runs "Microsoft Compatibility Appraiser" via Application Experience, consistent with persistence abuse.

Windows service configuration tampering via sc/reg with payload execution paths

Looks for sc/reg command-line activity that updates Windows service ImagePath or FailureCommand to run attacker-controlled payloads.

Windows COM Hijack by Registry DelegateExecute Modification (HKCU Classes Folder\shell\open\command)

Flags HKCU DelegateExecute registry changes for COM hijack style persistence under the Folder shell open command.

Windows VirtualBox Driver Registration or VM Startup via Process Command Line

Alerts on Windows processes whose command lines reference VirtualBox driver registration or VM start/control actions.

Detect Wannacry killswitch DNS queries to hardcoded domains

Flags DNS lookups for known WannaCry killswitch domain strings and variants.

Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client

Alerts on Windows NetLogon ETW events indicating an allowed secure channel connection (Event ID 5829).

Windows Defender Windefend AMSI Detection (Event ID 1116)

Flags Windows Defender AMSI detections via windefend Event ID 1116 with SourceName set to AMSI.

Windows Registry Set: .NET COR/CORECLR Profiling Environment Variables Enabled

Alerts on registry writes enabling .NET CLR/CORECLR profiling variables like COR_ENABLE_PROFILING and COR_PROFILER.

Windows Process Creation: MpCmdRun.EXE Used to Download Files via DownloadFile url

Alerts when MpCmdRun.exe is executed with DownloadFile and url, indicating Defender utility file download behavior.

WMI scrcons.exe Loading Script and WMI DLLs via Image Load (Windows)

Alerts when scrcons.exe loads vbscript/wbem/WMI script DLLs, suggesting WMI ActiveScriptEventConsumer activity.