Sigma detection rules, expert-reviewed

Windows Process Execution from Unusual System Locations

Alerts on Windows process launches where the executable path is in or contains unusual directories like RECYCLER or SystemVolumeInformation.

Windows Suspicious rasdial.exe Process Execution

Flags Windows process executions of rasdial.exe by matching process image names ending with rasdial.exe.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

PowerShell Spawned by wscript.exe or cscript.exe on Windows

Flags PowerShell launched by Windows script engines (wscript/cscript), excluding specific Health Service State activity.

Windows PowerShell execution with download-related command line patterns

Alerts when PowerShell is started with command-line fragments indicative of downloading remote content.

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).

Windows Process Reconnaissance via net.exe Group/Account Queries

Alerts on Windows net.exe commands querying groups and accounts via domain/local group and /do-related flags.

Windows Process Creation: Suspicious Children Spawned by mshta.exe

Flags mshta.exe spawning command, script, or utility processes commonly abused for executing malicious HTA payloads.

Windows Java Process Started with Remote Debugging Enabled for Non-Localhost Connections

Identifies Java processes started with JDWP dt_socket remote debugging on a non-localhost address.

Windows Cmdkey.EXE Cached Credential Reconnaissance

Alerts on cmdkey.exe running with -l to enumerate cached credentials on a Windows host.

Windows cmd.exe Command Line with URL and %AppData% Indicators

Alerts on cmd.exe executions whose command line includes a URL pattern (http/https) and %AppData%.

Windows Script File Execution via Wscript/Cscript Using Script File Extensions

Flags wscript.exe or cscript.exe executing common script file types via command-line extensions on Windows.

Windows: Process execution from web server root folders (wwwroot, htdocs, wmpub)

Alerts on Windows processes executing from typical web server root folders, consistent with webshell or backdoor staging.

Windows Process Creation: Execution of Net.exe or Net1.exe

Alerts on execution of net.exe/net1.exe with common net subcommands via Windows process creation and command-line telemetry.