Sigma detection rules, expert-reviewed

Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders

Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).

Windows Process Activity Indicative of QBot (WinRAR to wscript, ping/type, regsvr32)

Alerts on Windows process creation consistent with QBot-like script execution chains from WinRAR and regsvr32/tmp staging.

Windows Formbook-style process execution deleting dropped payloads from AppData Temp via cmd

Flags Windows process creation where an .exe runs deletion commands to remove dropper artifacts from AppData Temp/Desktop.

Windows Process Creation: Emotet-like Command-Line Patterns

Alerts on Windows process executions with command-line indicators consistent with Emotet-like staging and encoded payload usage.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.

Windows fsutil.exe Suspicious USN Journal and File Zeroing Parameters

Alerts when fsutil.exe is run with USN journal deletion/creation or setZeroData-style file zeroing commands.

Linux Service Reload/Start via systemctl or service Command Execution

Identifies Linux process executions invoking service control commands with start or reload keywords.

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

Linux auditd: Detect chattr -i removing immutable file attribute

Flags Linux processes using chattr to remove the immutable (-i) file attribute via auditd execve telemetry.

Windows Registry: Enable WDigest UseLogonCredential (Use clear-text logon credential setting)

Flags registry writes that enable WDigest UseLogonCredential, turning on potential clear-text credential storage.

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Windows Named Pipe Created for PowerShell PSHost Instance

Alerts on named pipe creation with a \PSHost prefix, indicating PowerShell host-related activity.

Windows Named Pipe Creation: Alternate PowerShell Host via \PSHost

Alerts on creation of \PSHost named pipes to identify alternate PowerShell host usage via Windows pipe events.