Every published rule

Windows Process Masquerading: msdtc.exe and gpsvc.exe launched from Non-System Paths

Alerts on msdtc.exe or gpsvc.exe launched from paths outside Windows System32/SysWOW64.

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

ComRAT Proxy HTTP Requesting index.php with h Parameter

Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.

Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.

Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation

Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).

Windows Registry: Office VBAWarning Disabled (VBAWarnings set to 1)

Alerts on Security\VBAWarnings being set to DWORD 0x00000001, enabling all Office VBA macros.

Windows Registry Set AccessVBOM DWORD=1 Disables Access Security for Access VBA

Alerts on Windows registry changes setting Security\AccessVBOM to DWORD 1, disabling VBA trust access to bypass Office warnings.

Windows: CrackMapExec PowerShell obfuscation via join/split static patterns

Flags Windows PowerShell executions with command-line obfuscation strings associated with CrackMapExec behavior.

Windows Network Connections Initiated by Notepad.exe

Alerts when notepad.exe initiates an outbound network connection, excluding typical printing traffic on port 9100.

Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

Alerts on Windows registry writes to a specific Services\wercplsupport\Parameters\ServiceDll target path.

Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.

Windows Registry Ports Key Changes with Script/Binary File Indicators

Flags registry modifications to the Ports key with path- or executable/script-like details that may indicate printer-based exploitation attempts.

Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths

Flags suspicious Add-PrinterPort usage referencing .exe/.dll/.bat or “Generic / Text Only” in Windows process command lines.

Windows: Detect rar.exe Archive Creation Using Password or Compression Options

Alerts on rar.exe command lines that include both password protection (-hp) and additional compression/archive flags.

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Security Log: Metasploit SMB NTLM Logon (4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.