Sigma detection rules, expert-reviewed

Windows: WinSxS .exe Creation Triggered by Non-System Process

Flags .exe creation in C:\Windows\WinSxS\ when the creating process is not from standard system directories.

Windows Registry Events Targeting SECURITY\Policy\Secrets\ (Snake Malware)

Alerts on Windows registry activity targeting the SECURITY\Policy\Secrets\n registry key suffix.

Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe

Alerts on Windows service creation of WerFaultSvc pointing to C:\Windows\WinSxS\...\WerFault.exe.

Windows Registry Persistence: Uncommon .wav OpenWithProgIds Value Creation

Flags registry value writes under .wav OpenWithProgIds with unusual naming that may indicate persistence behavior.

Windows File Creation: Non-System WerFault.exe Created in WinSxS

Flags creation of C:\Windows\WinSxS\WerFault.exe by processes outside core Windows system directories.

Windows file events matching SNAKE-related installer filename indicators

Flags Windows file events with target filenames ending in common SNAKE installer indicators like jpsetup.exe and jpinst.exe.

Windows File Indicator: SNAKE Malware Kernel Driver Target File Comadmin.dat

Alerts on Windows file events involving C:\Windows\System32\Com\Comadmin.dat, an indicator tied to SNAKE kernel driver activity.

PowerShell ScriptBlock Function Get-VMRemoteFXPhysicalVideoAdapter Module Creation

Flags PowerShell module content that defines Get-VMRemoteFXPhysicalVideoAdapter in a ScriptBlock, consistent with load-order abuse patterns.

Windows: New PowerShell Module Files Created by Non-PowerShell Processes

Detects new PowerShell module files written into Modules directories by processes other than expected PowerShell hosts.

Windows PowerShell Module File Creation via PowerShell Processes

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.

Windows PowerShell Import-Module Cmdlet Execution

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

System Informer Execution on Windows Process Creation

Alerts on Windows executions of SystemInformer.exe using matching filenames, metadata, and known hashes.

Windows File Event: Flag Cyrillic Homoglyph Characters in Target Filename

Alerts on Windows file events with TargetFilename containing ASCII lookalike Unicode characters.

Windows PUA System Informer Driver Load via SystemInformer.sys

Alerts on loading SystemInformer.sys as a Windows driver when matched against known System Informer SHA256 hashes.