Sigma detection rules, expert-reviewed

Windows PowerShell Script Block Matching POWERTRASH Behavior Indicators

Detects PowerShell ScriptBlock text containing POWERTRASH-related in-memory and dynamic execution indicators on Windows.

PowerShell ScriptBlock Launching wscript.exe via PowerHold-like Code Patterns on Windows

Flags PowerShell ScriptBlock text that writes staged bytes in APPDATA and launches wscript.exe.

Windows PowerShell Script File Creation Matching FIN7-Style Filenames

Alerts on Windows PowerShell script drops named host_ip.ps1 or ending with _64refl.ps1.

Windows process execution: WerFault.exe launched from WinSxS by services.exe

Alerts on WerFault.exe running from WinSxS when spawned by services.exe on Windows.

Windows Process Creation: Detect jpinst.exe/jpsetup.exe Installation Binary Indicators

Detects execution of jpinst.exe or jpsetup.exe on Windows, indicative of SNAKE installation activity.

Windows process command line matches SNAKE installer argument pattern

Alerts on Windows process command lines containing a 64-hex then 16-hex CLI argument sequence consistent with a malware installer pattern.

Windows Non-Browser Process Network Connection to api.notion.com

Alerts when a non-browser Windows process connects to api.notion.com, excluding common browsers and the Notion desktop app.

Windows Service Creation via SCM (Event ID 7045) with svchost.exe and specific service names

Alerts on Windows 7045 service creations where ImagePath contains svchost.exe and service names match Name/msupdate/msupdate2.

Windows Registry User Profile Creation: ANONYMOUS _DomainUser_ Entries in ProfileList

Alerts on ProfileList registry writes indicating a new user profile with 'ANONYMOUS' and '_DomainUser_' markers.

Windows svchost.exe Loading newdev.dll from AppData Roaming (Potential Persistence)

Alerts on svchost.exe loading newdev.dll from AppData\Roaming, an unusual pattern consistent with stealthy persistence.

Windows Suspicious Non-Browser Network Connections to Google API Endpoints

Alerts on suspicious Windows processes connecting to Google API hostnames, excluding common browsers and known benign apps.

Windows Process Creation: svchost.exe with msupdate/alg Service Flags

Alerts on svchost.exe started with specific -k command-line flags consistent with suspicious persistence activity.

Windows rundll32 Cleanup Export Execution via msupdate Service Host (ColdSteel)

Flags svchost.exe msupdate-style services spawning rundll32.exe to run cleanup-related exports.

Windows Process Execution with User Name "ANONYMOUS" from System32 or AppData

Alerts on Windows process executions where the user is marked "ANONYMOUS" and the parent path is in System32 or AppData.

Windows: Detect newdev.dll created in AppData\Roaming\ starting from C:\Users\

Detects creation of newdev.dll under a user’s AppData\Roaming directory for potential user-scoped persistence.