Sigma detection rules, expert-reviewed

Windows Process Execution: curl.exe Saving Cookies via -c / --cookie-jar

Flags curl.exe commands that save cookie jar data using -c/--cookie-jar on Windows process creation events.

Windows Terminal settings.json modified by uncommon process

Alerts on Windows Terminal settings.json changes made by an uncommon command-line or script host process.

Windows net.exe Uses QUIC Transport to Mount SMB Shares

Alerts on net.exe commands mounting SMB shares over QUIC transport (/TRANSPORT:QUIC), using process creation logs.

Windows PowerShell ScriptBlock WinAPI Function Calls

Find PowerShell script blocks that reference WinAPI/native-call function names tied to process, memory, token, or thread operations.

PowerShell Scripts Calling WinAPI DLLs on Windows

Detects PowerShell script blocks that reference WinAPI-related Windows DLLs such as kernel32.dll and ntdll.dll.

PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping

Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.

Windows Sysmon FileExecutableDetected (Event ID 29) Alerts on New Executable Files

Alerts on any Sysmon Event ID 29 indicating a new monitored executable file was created on Windows.

Sysmon FileBlockShredding Policy Violations (Event ID 28) on Windows

Alerts on Sysmon Event ID 28 when file shredding is blocked by the configured shredding policy on Windows.

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

Windows netsh.exe Advanced Firewall Rule Set Modification

Flags netsh.exe command lines that invoke advfirewall firewall set to modify existing Windows firewall rule properties.

Windows Process Creation: One-liner cmd.exe CommandLine with ping and copy

Alerts when cmd.exe runs a one-liner that includes both ping and copy with expected options.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.