Sigma detection rules, expert-reviewed

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.

Windows Process Loaded BitsProxy.dll via Uncommon Image

Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.

Linux mknod Syscall Used to Create Special Files

Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

Windows: Deno writes files from remote HTTPS content into AppData

Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.

Windows File Access to Browser Credential Storage by Non-Browser Processes

Flags non-browser processes reading common browser credential storage files on Windows, indicating potential credential theft.

Windows Process Execution of JavaScript via Node.exe

Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

Windows Process Creation: Microsoft QuickAssist.exe Execution

Alerts on execution of QuickAssist.exe by matching the process image ending with \QuickAssist.exe.

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Alerts when QuickAssist.exe performs DNS lookups for the Microsoft Quick Assist remote session endpoint.

Windows Command Execution via Run Dialog (RunMRU) Registry Entries

Flags suspicious Run dialog command entries by matching RunMRU registry key updates on Windows.

Windows Security 4663: Uncommon Processes Access Browser Credential Store Files

Flags 4663 file access to browser credential stores (Chromium/Firefox) by processes outside common system/benign paths.

Windows IIS module removal event (IIS-configuration EventID 29)

Detects removal of an IIS module from Windows IIS configuration events (Event ID 29).

Windows Task Scheduler DLL Loaded From Uncommon Directory

Flags taskschd.dll being loaded by a process from Temp/public/user directories commonly abused for malicious activity.