Sigma detection rules, expert-reviewed

Windows Registry: New ODBC Driver Registration via ODBCINST.INI

Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.

Windows: Odbcconf.EXE INSTALLDRIVER Use With Missing .dll Target

Flags odbcconf.exe running INSTALLDRIVER when the driver argument lacks a .dll extension.

Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

Windows: Uncommon Child Process Spawned by Odbcconf.EXE

Alert on unusual child processes spawned from odbcconf.exe, which may indicate indirect execution abuse.

Windows Process Execution of Odbcconf.exe with -f Response File Flag

Alerts on Odbcconf.exe being run with -f to load a response file, excluding runonce-driven executions.

Windows Odbcconf.EXE Response File Execution via -f Flag

Flags Windows executions of Odbcconf.EXE using -f to load a .rsp response file.

Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.

Windows: Odbcconf.exe used to register a DLL via REGSVR

Flags odbcconf.exe executions using REGSVR to register a DLL, a regsvr32-equivalent technique often abused by attackers.

Windows Process Execution: odbcconf.exe with DLL in Suspicious Path

Flags odbcconf.exe process launches when the command line references DLL-related paths in suspicious Windows locations.

Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line

Alerts when odbcconf.exe is run with INSTALLDRIVER and a .dll, indicating potential malicious ODBC driver DLL installation.

Windows Suspicious Non-Browser Network Traffic to api.telegram.org

Alerts on Windows network connections to api.telegram.org by processes other than common web browsers.

Windows Security Event 4661 Password Policy Enumeration via ReadPasswordParameters

Flags Windows Event 4661 activity indicating password policy enumeration (ReadPasswordParameters on Security Account Manager).

Windows Registry Run Key Persistence Using Small Sieve Typo Value Strings

Flags registry Run-key writes on Windows with Small Sieve-specific typo and executable detail strings in value data.

Proxy HTTP GET to api.telegram.org with chat_id and text com/ (Small Sieve C2 behavior)

Alerts on proxy HTTP GET requests to api.telegram.org containing a specific chat_id and com/ prefix consistent with C2 behavior.

Windows Process Creation: Detects Command-Line Ending With '.exe Platypus'

Alerts when a Windows process command line ends with '.exe Platypus', matching a Small Sieve indicator.