Sigma detection rules, expert-reviewed

Windows Service Control Manager flags smbexec.py-style service installation via suspicious ImagePath

Flags suspicious Windows service installations matching a specific service name and BAT/delete command patterns in Event 7045.

Windows Security: Registry NetNTLM Downgrade Configuration Changes

Alerts on Windows registry changes that weaken NetNTLM/NTLM security settings via LSA compatibility and restriction values.

Windows Process Creation: taskmgr.exe launched in LOCAL_SYSTEM context

Flags taskmgr.exe process creation when initiated under a LOCAL_SYSTEM-equivalent user context string.

Windows Suspicious RDP Session Redirect via tscon.exe /dest:rdp-tcp#

Alerts on Windows process executions using tscon.exe-style RDP redirection to an "rdp-tcp#" destination.

Windows: Detect tscon.exe launched under SYSTEM context

Alerts on tscon.exe starting under a SYSTEM-associated user context based on Windows process creation logs.

Windows Registry Image File Execution Options Debugger Backdoor (sethc.exe/utilman.exe/osk.exe)

Alerts on registry Debugger hijacks for Windows login/accessibility binaries using Image File Execution Options.

Windows Backdoor Execution via Sticky Keys and Login-Screen Accessibility Tools

Flags winlogon.exe spawning command/script tools referencing login-screen accessibility binaries (sethc.exe, utilman.exe, osk.exe, etc.).

Windows Process Creation with taskmgr.exe as Parent Process

Flags process creation where taskmgr.exe is the parent, excluding a few known benign child process images.

Windows WMI Script Event Consumer Execution via scrcons.exe

Flags scrcons.exe starting under svchost.exe, indicating WMI script event consumer execution that can support persistence.

Windows WMI Persistence via wbemcons.dll Loaded by WmiPrvSE.exe

Identifies WmiPrvSE.exe loading wbemcons.dll, a behavior consistent with WMI command line event consumer persistence on Windows.

Windows WMI Persistence: Script Event Consumer File Writes (scrcons.exe)

Flags file writes performed by scrcons.exe, indicating potential WMI script event consumer persistence activity.

Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY

Flags PowerShell-launched schtasks.exe /Create commands matching default PowerSploit/Empire scheduled task persistence behavior.

Windows rundll32 Trojan Loader Execution via Local AppData and .dat Parameters

Flags rundll32.exe launched with AppData/local .dat and .dll patterns consistent with Trojan loader behavior.

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Alerts when Winword spawns a FLTLDR.exe child process, matching a CVE-2017-0261-style exploit chain.

WinWord spawning MicroScMgmt.exe indicative of CVE-2015-1641 exploitation on Windows

Alerts when Winword.exe starts MicroScMgmt.exe, matching a known CVE-2015-1641 exploitation behavior.