Sigma detection rules, expert-reviewed

PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping

Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.

Windows Sysmon FileExecutableDetected (Event ID 29) Alerts on New Executable Files

Alerts on any Sysmon Event ID 29 indicating a new monitored executable file was created on Windows.

Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows

Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

Windows netsh.exe Advanced Firewall Rule Set Modification

Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Alerts when cmd.exe runs a one-liner that includes both ping and copy with expected options.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

Windows DLL Sideloading: CCleanerReactivator.dll Loaded from CCleaner Directories

Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.

Windows DLL Sideloading via CCleanerDU.dll ImageLoad from CCleaner Folder

Alerts when CCleanerDU.dll is loaded, but the loading image is not CCleaner executables in standard install paths.

PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

Windows Security 5140 File Share Access to MSHTML_C7 IP-Named Paths

Alerts on Windows file share access events targeting \MSHTML_C7\ shares with an IP-like naming pattern (EventID 5140).

Windows Office Recent Folder Dropped URL File (file001.url) Creation

Alerts on creation of file001.url in Microsoft Office Recent under C:\Users\, indicating potential exploit staging.