Sigma detection rules, expert-reviewed

Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell

Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.

Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Alerts on reg.exe or PowerShell command lines attempting to add/set AMSI enable registry settings.

Windows File Write by Common Executables to Uncommon Locations

Alerts when selected Windows binaries write files to typically uncommon directories such as Temp, ProgramData, AppData, or system areas.

Web Browser Opens .HTM/.HTML from Downloads Folder on Windows

Flags browser processes opening .htm files from a user’s Downloads folder on Windows, a pattern consistent with HTML attachment activity.

Linux process creation: suspicious child processes launched by Node.js server command execution

Flags Linux processes where a Node.js server child-process pattern launches suspicious shell/command tooling.

Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

Alerts on Windows process activity from GitHub self-hosted runner Worker/Listener indicating spawnclient or run/configure operations.

Windows Process Creation: npm install for Shai-Hulud 2.0 Malicious Package Names and Versions

Alert on Windows node.exe running npm install with command-line package/version strings known from the Shai-Hulud 2.0 npm campaign.

Linux Process Creation: Installation of Known Malicious NPM Packages (Shai-Hulud 2.0)

Alerts on Linux npm install commands referencing known Shai-Hulud 2.0 malicious package versions.

Windows Schtasks.exe renamed execution used to create, modify, run, or delete scheduled tasks

Alerts on scheduled task management commands that use a renamed schtasks.exe binary on Windows.

Windows Process Access: WerFaultSecure accessing MsMpEng with dbgcore.dll/dbghelp.dll call traces

Alerts on WerFaultSecure.exe accessing MsMpEng.exe with dbgcore/dbghelp DLLs in the call trace.

Windows suspicious access to LSASS.exe with dbgcore.dll/dbghelp.dll call trace from uncommon paths

Alerts on suspicious LSASS access from unusual locations when dbgcore.dll or dbghelp.dll appears in the call trace.

Windows Image Load: dbgcore.dll/dbghelp.dll Loaded from Uncommon User and System Paths

Alerts when dbgcore.dll or dbghelp.dll is loaded from user or other uncommon directories on Windows.

AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector

Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.

WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)

Alerts on WerFaultSecure.exe loading dbgcore.dll or dbghelp.dll, a behavior tied to EDR impairment and potential monitoring evasion.

Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combination

Alerts on Windows command lines containing Grixba-like mode/input/scan parameter combinations during reconnaissance.