Sigma detection rules, expert-reviewed

Windows ScheduledDefrag task removal via schtasks /delete and /change

Detects schtasks.exe commands that delete or change the ScheduledDefrag scheduled task.

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows mshta.exe Execution Using Non-HTA File Extensions

Alerts on mshta.exe launched with command-line indicators for suspicious non-HTA file types and VBScript.

Windows: RDP Session Startup Folder Backdoor via tsclient Share Targeting Startup Path

Flags mstsc.exe activity writing to the Windows Startup folder, indicating potential RDP session backdoor placement.

Windows svchost RDP via Reverse SSH Loopback Tunnel to 127.0.0.0/8:3389

Flags svchost.exe opening RDP (TCP 3389) connections to loopback, consistent with tunneled reverse access behavior.

Windows WFP Event 5156: RDP traffic via loopback when hosted by svchost termsvcs

Flags Windows EventID 5156 where svchost RDP (3389) traffic targets loopback addresses, suggesting tunneled local RDP usage.

Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path

Alerts on Windows registry key additions matching a Ursnif-associated TargetObject path.

Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

Windows PowerShell Script Block Matches Common Reflection and Injection Keywords

Alerts on PowerShell script block text containing reflection, dynamic assembly loading, and injection-related keywords.

Windows Process Creation: Suspicious calc.exe Command-Line Usage Outside System Locations

Alerts on suspicious calc.exe launches via command-line parameters or execution from non-standard Windows directories.

Windows bcdedit.exe Tampering for MBR/Boot Persistence (Delete, Import, SafeBoot, Network)

Alerts on bcdedit.exe executions with command-line options consistent with boot configuration tampering.

Windows Process Creation: Suspicious GUP.exe Execution from Non-Notepad++ Directories

Alerts on GUP.exe executions from unexpected directories on Windows, excluding known Notepad++ updater paths.

Windows Security Event 4616 for System Time Changes by Non-Service Accounts

Flags Windows Event 4616 system time changes when made by processes outside svchost.exe and common virtualization agents.