Sigma detection rules, expert-reviewed

Windows Registry: New AppCompatFlags custom shim databases targeting system processes

Alerts on Windows registry writes to AppCompatFlags Custom shim paths targeting common system processes.

Windows sdbinst.exe Installing Shim Database with Uncommon Extension

Flags sdbinst.exe process executions consistent with installing shim databases using uncommon .sdb command-line patterns.

Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll

Alerts when VMMap loads an unsigned dbghelp.dll from C:\Debuggers, suggesting DLL sideloading on Windows.

Windows CreateRemoteThread in mstsc.exe From Suspicious Source Paths

Alerts when mstsc.exe creates remote threads from processes running out of common suspicious directories.

FortiGate Web Exploitation Indicators for CVE-2023-27997 via Remote Host/Login Checks

Flags GET/POST requests to FortiGate /remote validation/login endpoints containing "enc=" as potential CVE-2023-27997 exploitation indicators.

Windows: Alert on wget.exe downloading files from an IP with output flags

Flags Windows wget.exe usage to download HTTP URLs from IPs and write outputs to script/binary extensions.

Windows: curl.exe Local File Read via file:/// Command Line

Flags curl.exe runs that include file:/// to access local files on Windows.

Windows: Curl.exe Insecure Proxy/DOH Transfer Flags

Flags curl.exe with --proxy-insecure and/or --doh-insecure during Windows process execution.

Suspicious curl.exe File Downloads From Direct IP Addresses on Windows

Alerts on Windows curl.exe commands downloading from an IP address with HTTP/S and suspect file extensions.

Windows Process Execution: curl.exe with Custom User-Agent Header

Flags Windows executions of curl.exe that include a User-Agent header in the command line.

Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar

Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.

Windows Terminal settings.json modified by uncommon process

Alerts on Windows Terminal settings.json changes made by an uncommon command-line or script host process.

Windows net.exe Uses QUIC Transport to Mount SMB Shares

Alerts on net.exe commands mounting SMB shares over QUIC transport (/TRANSPORT:QUIC), using process creation logs.

Windows PowerShell ScriptBlock WinAPI Function Calls

Find PowerShell script blocks that reference WinAPI/native-call function names tied to process, memory, token, or thread operations.

PowerShell Scripts Calling WinAPI DLLs on Windows

Detects PowerShell script blocks that reference WinAPI-related Windows DLLs such as kernel32.dll and ntdll.dll.