Sigma detection rules, expert-reviewed

Windows DLL Sideloading: WmiApSrv Loads VMGuestLib.dll

Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.

Windows DLL Sideloading via Loading ShellChromeAPI.dll

Alerts when Windows processes attempt to load ShellChromeAPI.dll, a DLL typically not present on systems.

Windows: Creation of Non-Existent System DLLs in System32 Paths

Alerts when targeted non-existent system DLL filenames are created in Windows system directories, indicating potential DLL hijacking setup.

Windows: Gpg4win (GnuPG) Encrypt/Decrypt Command Using Suspicious File Paths

Flags Gpg4win/GnuPG file crypto commands using -passphrase with activity in temporary/public or suspicious Windows directories.

Windows PowerTool Process Execution

Flags Windows process creation events where PowerTool.exe/PowerTool64.exe is launched.

Windows Service Installation: TacticalRMM Agent Service (SCM Event 7045)

Flags Windows service installations that include tacticalrmm.exe and the TacticalRMM Agent Service using SCM Event ID 7045.

Windows Service Control Manager: Mesh Agent Service Installation via Service Creation (7045)

Flags Windows Event ID 7045 service installations that reference MeshAgent.exe or “Mesh Agent”.

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

Windows UAC Bypass via Event Viewer RecentViews Path in Process Command Line

Flags Windows processes whose command lines reference Event Viewer RecentViews and use redirection, consistent with UAC bypass techniques.

Windows Registry NGenAssemblyUsageLog Key Tampering via .NET Usage Log Configuration

Alerts on registry modifications to the .NETFramework NGenAssemblyUsageLog key that can disrupt .NET Usage Log creation.

Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

Flags secedit.exe command lines used to export or configure Windows security policy.

Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout

Detects powercfg.exe commands attempting to change standby/lock-related timeouts on Windows.

Windows: Suspicious Msbuild.exe execution from uncommon parent process

Alerts when Msbuild.exe runs under an unexpected parent process on Windows.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.