Sigma detection rules, expert-reviewed

Windows Process Creation From Fake Recycle.Bin Directories

Alerts on Windows processes launched from fake RECYCLER.BIN / RECYCLERS.BIN folder paths often used for stealth.

Windows: wordpad.exe Initiated Network Connections on Uncommon Ports

Alerts when wordpad.exe initiates outbound connections on destination ports outside common C2-related ports.

Windows Office Apps Initiating Network Connections to Non-Common Ports

Alerts on network connections initiated by Windows Office apps to destination ports not in the common port set.

Windows: Suspicious File Creation in Fake RECYCLER.BIN Staging Folders

Alerts on Windows file writes involving RECYCLERS.BIN\ or RECYCLER.BIN\ paths often used for staging.

HTTP GET Requests Containing /MSHTML_C7/ URL Marker (Proxy Logs)

Alerts on proxy HTTP GET requests whose URI contains /MSHTML_C7/.

Proxy GET Requests for Suspicious File and Redirect Paths Associated with CVE-2023-36884

Alerts on proxy HTTP GET requests for specific suspicious file-download URI patterns associated with CVE-2023-36884-style activity.

Proxy GET Requests with IP-Embedded CVE-Related URL Parameters

Finds proxy GET URIs with risky extensions and a d=IPv4 parameter value in the query string.

Proxy HTTP GET Pattern Matching /MSHTML_C7/ with IPv4 Query Parameters

Alerts on proxy HTTP GET requests to /MSHTML_C7/ with an IPv4-like query parameter pattern.

Windows DLL Sideloading via Abusable DLLs Loaded from Suspicious Locations

Flags Windows module loads of specific abusable DLL names from public, temp, or user folders consistent with potential DLL sideloading.

Windows PowerShell Script Accessing Windows MailApp MailBox Data Path

Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.

Windows: Recon command output piped to findstr.exe

Alerts on Windows command lines running recon commands whose output is filtered with findstr.exe.

PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

Identifies PowerShell script blocks querying sensitive registry keys tied to services and Run/Explorer/winlogon locations.

Windows process creation: WerFault.exe executed with -pr flag

Alerts when WerFault.exe is launched with the -pr argument, potentially indicating ReflectDebugger-based execution.

Windows PowerShell Decryption-Like Activity Involving .LNK File Processing

Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.

Windows Process Execution of curl.exe with --insecure Flag

Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.