Sigma detection rules, expert-reviewed

Windows: Alert on Suspicious Child Processes Spawned by provlaunch.exe

Detects provlaunch.exe launching suspicious child executables and processes from common temp/task paths on Windows.

Windows Named Pipe Creation: Default RemCom Pipe Name

Alerts on creation of named pipes with names containing "\RemCom" on Windows.

Windows Named Pipe Created for CSExec Default Pipe Name

Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.

Windows RemComSvc Service Installation and Execution

Flags Windows service installation events for RemComSvc.exe via Service Control Manager (Event ID 7045).

Windows Service Control Manager Detects CSExecSvc Installation and Execution

Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).

Azure risk detection: anomalousToken risk events

Flags Azure Entra ID risk events indicating anomalous token lifetime or use from unfamiliar locations.

Windows Browser-Injected rundll32 Execution Indicative of GuLoader Activity

Flags rundll32.exe being launched from a browser process, matching GuLoader-style injected browser execution behavior on Windows.

Windows Portable Gpg.exe Execution from Uncommon Paths

Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.

Windows RemCom Service File Creation via RemComSvc.exe Filename

Flags creation of a RemCom service executable file (\RemComSvc.exe) on Windows.

Windows CSExec Service File Creation (csexecsvc.exe)

Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.

Windows: VSDiagnostics.EXE started with launch parameters to proxy arbitrary binaries

Alerts when VSDiagnostics.exe is started with launch arguments that may be used to proxy other binaries on Windows.

Windows: Detect ImageLoad of vivaldi_elf.dll for Potential DLL Sideloading

Flags ImageLoad events for vivaldi_elf.dll on Windows that are not consistent with an expected Vivaldi app path.

Windows DLL Sideloading via mfdetours.dll using mftrace.exe

Alerts on mfdetours.dll loads that may indicate DLL sideloading outside the expected Windows Kits location.

Windows ImageLoad DLL Sideloading: EACore.dll

Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.

Windows DLL sideloading via AVKkid.dll image loads

Identifies suspicious AVKkid.dll loads on Windows that may indicate DLL sideloading, excluding a specific likely legitimate path pattern.