Sigma detection rules, expert-reviewed

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Windows Bash.exe Launched Without Script Execution Arguments

Alerts on bash.exe launched without script-execution flags, a potential stealthy way to run bash-driven payloads on Windows.

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Alerts when aspnet_compiler.exe runs with command lines indicating user-writable or temp/task paths.

Suspicious Child Process of aspnet_compiler.exe on Windows

Alerts when aspnet_compiler.exe spawns calc/notepad or executes from public/temp/Task-related paths on Windows.

Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs

Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.

Windows DLL sideloading via unsigned mfdetours.dll loaded by image_load

Alerts on loading unsigned \mfdetours.dll, consistent with DLL sideloading abuse via mftrace.exe.

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.

Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe

Flags Gpg4win (gpg.exe/gpg2.exe) executions using passphrase-based encryption on Windows.

Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)

Identifies Windows Gpg4win (gpg.exe/gpg2.exe) decryption commands that include a passphrase keyword.

Windows Provisioning Registry Key Abuse Leading to Indirect Execution via Provlaunch.exe

Flags Windows command lines referencing the provisioning commands registry path commonly abused for Provlaunch.exe-based indirect execution.

Windows: Alert on Suspicious Child Processes Spawned by provlaunch.exe

Detects provlaunch.exe launching suspicious child executables and processes from common temp/task paths on Windows.

Windows Named Pipe Creation: Default RemCom Pipe Name

Alerts on creation of named pipes with names containing "\RemCom" on Windows.

Windows Named Pipe Created for CSExec Default Pipe Name

Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.

Windows RemComSvc Service Installation and Execution

Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).

Windows Service Control Manager Detects CSExecSvc Installation and Execution

Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).