Sigma detection rules, expert-reviewed

Windows DNS Client: MEGA userstorage subdomain DNS query (EventID 3008)

Detects Windows DNS client queries for MEGA userstorage subdomains by matching the query name string.

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.

Windows DNS Client: DNS query for anonfiles.com domain

Alerts when Windows DNS client logs show a DNS query containing .anonfiles.com.

Windows AppX Packaging: Execute AppX with Suspicious Digital Signature Certificate

Alerts when AppX package execution/signature subject matches a known suspicious certificate in Windows telemetry.

Windows AppX Execution of Sysinternals Tools (procdump/psloglist/psexec/livekd/ADExplorer)

Flags execution of common Sysinternals binaries when launched through the Windows AppX runtime.

Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence

Flags registry writes that reference an Excel XLL add-in via a '/R ' command under Excel Options.

Windows Registry: DisableRestrictedAdmin Value Tampering to Change Restricted Admin Mode

Flags registry modifications to DisableRestrictedAdmin that change Restricted Admin mode settings.

Windows Process Creation: Registry Tampering of DisableRestrictedAdmin in Lsa Key

Alerts when a process command line references LSA DisableRestrictedAdmin to change RestrictedAdmin behavior via the registry.

Windows Task Scheduler: Detects Scheduled Task Deletion or Disabling (Task Deleted/Disabled)

Alert on deletion or disabling of targeted Windows scheduled tasks tied to system, security, and update components.

Windows LSA event: Standard user SID in privileged AD groups (EventID 300)

Alerts when LSA Event 300 shows a standard user interacting with high-privileged group SIDs, excluding common domain admin patterns.

Windows Registry change enabling developer features for sideloading and untrusted app installs

Alerts on registry writes that enable Windows developer feature policies allowing sideloading of untrusted apps.

Windows process creation: Suspicious child processes from WindowsApps directory

Alerts on suspicious cmd/PowerShell/mshta/rundll32-style child processes launched from Program Files\WindowsApps.

Windows SRP restricted application access (Event IDs 865, 866, 867, 868, 882)

Flags Windows SRP enforcement events where attempts to access applications are restricted by administrator policy.

Linux mount executed with hidepid=2 option

Flags Linux mounts that include hidepid=2, a stealth configuration that hides processes from other users.

Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)

Alerts on Windows registry changes that set PowerShell ExecutionPolicy to Bypass or Unrestricted.