Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

Flags secedit.exe command lines used to export or configure Windows security policy.

Windows: Suspicious Powercfg Execution Changing Lock/Video Standby Timeout

Detects powercfg.exe commands attempting to change standby/lock-related timeouts on Windows.

Windows: Suspicious Msbuild.exe execution from uncommon parent process

Alerts when Msbuild.exe runs under an unexpected parent process on Windows.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

Microsoft 365 Threat Management: PST Export via New-ComplianceSearchAction -Export

Flags M365 SecurityComplianceCenter activity that includes New-ComplianceSearchAction with -Export for PST content.

Windows file activity matching CrackMapExec/Impacket-secretsdump credential dumping temp output patterns

Alerts on Windows temp file creations consistent with CrackMapExec or Impacket-secretsdump credential dumping activity.

Windows Driver Load: Process Hacker (processhacker.sys) Presence

Flags Windows driver loads of Process Hacker’s processhacker.sys using path and known imphash indicators.

Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination

Flags Windows processes with both target-user and target-command flags in the same command line.

PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

Windows: Detect sftp.exe used as a LOLBIN via -D option

Alerts on Windows executions of sftp.exe using the -D flag with a path argument.

Windows Code Integrity blocked image/driver loads due to signature level or policy violations

Alerts on Windows Code Integrity Event ID 3077 when an image/driver load is blocked for signing-level or policy violations.

Windows Process Creation: Sysmon.exe as Parent of Spawned Process

Alerts when Sysmon.exe/Sysmon64.exe is the parent of a new process, a potentially suspicious execution chain on Windows.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).

Windows System: Kerberos KDC RC4-HMAC downgrade exploit attempts (CVE-2022-37966)

Identifies Windows Kerberos KDC error events tied to RC4-HMAC downgrade/auth negotiation exploitation behavior (CVE-2022-37966).