Sigma detection rules, expert-reviewed

Windows LiveKD Driver File Creation by Uncommon Process Image

Alerts when LiveKdD.SYS is created by a process other than livekd.exe/livek64.exe on Windows.

Windows LiveKD Driver Creation via LiveKdD.SYS and LiveKD Executable Launch

Detects creation of LiveKdD.SYS in the Windows drivers directory by LiveKD executables.

Windows: LiveKD kernel memory dump file creation (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

Proxy Web Requests Matching Devil Bait C2 HTTP Parameters

Identifies proxy HTTP GET requests to /cross.php containing op, dt, and uid query parameters consistent with potential C2 traffic.

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Flags wscript.exe/cscript.exe launching files named with uncommon non-script extensions via command-line content.

Suspicious rundll32/regsvr32/msiexec Child Process from Windows Script Hosts (cscript/wscript)

Alerts on wscript/cscript spawning suspicious child processes or scripts that invoke rundll32/regsvr32/msiexec.

Windows Process Creation: LiveKD Execution Suggesting Potential Memory Dumping

Detects launching LiveKD (livekd.exe/livekd64.exe) on Windows via image path or PE OriginalFileName metadata.

Windows Process Creation of Kernel Debugger kd.exe

Flags Windows process creations that run kd.exe using image path and OriginalFileName metadata.

Suspicious Child Process of GoogleUpdate.exe on Windows

Alerts when GoogleUpdate.exe spawns an unexpected child process on Windows, using parent/child image telemetry and allowlisting common Google updaters.

Windows Process Creation: certutil.exe Encodes Files to Base64 in Suspicious Paths

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows DLL Sideloading: goopdate.dll Loaded from Nonstandard Paths

Alerts when goopdate.dll is loaded from non-standard locations, suggesting possible DLL sideloading behavior on Windows.

Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators

Flags Windows command lines that copy SolidPDFCreator.dll and set a Run registry key for auto-execution.

Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)

Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.

Windows: GoogleUpdate.exe Self-Spawn From Uncommon Path

Alerts when GoogleUpdate.exe launches another GoogleUpdate.exe from an unusual directory.