Sigma detection rules, expert-reviewed

Windows Log4j/Wstomcat-related Process Execution via ws_tomcatservice.exe Parent

Detects processes spawned by ws_tomcatservice.exe on Windows, excluding repadmin.exe, to surface potential Tomcat exploitation.

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows mstsc.exe launched with a local .rdp file from suspicious paths

Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.

Windows mstsc.exe launched with local .rdp file argument

Alerts on mstsc.exe executions that reference local .rdp files via the command line.

Windows: Uncommon Process Creates .rdp Remote Desktop File

Alerts on creation of .rdp files by processes that are not typically associated with producing them on Windows.

Windows winget Install from Zone.Identifier/WinGet Temp Contents Marked by Zone Transfer

Alerts on winget staging under Temp\WinGet combined with ZoneTransfer ZoneId=3 and Zone.Identifier ADS contents.

Windows Registry: Winget EnableLocalManifestFiles Set to DWORD 1

Flags setting the Winget AppInstaller local manifest installation policy (EnableLocalManifestFiles) to enabled.

Windows winget AppInstaller admin_settings registry modification via winget.exe

Detects winget.exe-driven changes to AppInstaller admin_settings in the registry under LocalState\admin_settings.

Windows Process: winget adds new download source via 'source add' with IP/endpoint

Alerts on winget.exe being used to add a new package download source specified by an IP address.

Windows Winget adds HTTP package source

Alerts when winget is used to add a package source pointing to an http:// URL.

Windows: winget.exe adds new download sources via 'source add'

Alerts on winget.exe usage to add new package download sources using 'source add'.

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.

Windows: Stracciatella.exe Process Execution Identification (SharpPick behavior)

Alerts on Windows process creation for Stracciatella.exe using PE metadata and known SHA256 hashes.

Windows Process Creation: Certipy Tool Execution Based on PE and CLI Parameters

Flags Certipy.exe execution on Windows using PE metadata and Certipy-like AD CS command-line arguments.