Sigma detection rules, expert-reviewed

Windows svchost.exe Spawning Office Applications via COM Object Execution

Flags svchost.exe creating new Office app processes (Word/Excel/PowerPoint/etc.), consistent with Office COM automation.

Windows: ssh.exe RDP tunneling to :3389 via SSH

Alerts on Windows process executions of ssh.exe that reference RDP port :3389 for SSH tunneling.

Port Forwarding via SSH.EXE on Windows

Flags Windows executions of ssh.exe using remote port forwarding (-R) based on process creation command-line content.

Windows Credential Manager Vault/File Access by Uncommon Application Images

Alerts on access to Windows credential/vault files by uncommon processes based on image path and file location.

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Alerts on Process Hacker being executed on Windows when process creation metadata or hashes match known indicators.

Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups

Flags PowerShell Get-LocalGroupMember usage targeting notable local group names in process creation logs.

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Flags Windows execution of PCHunter64/32.exe using image path plus PE metadata and known hashes.

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters

Flags Windows executions of npc.exe with NPS server, vkey/password, or config=npc command-line parameters.

Windows Execution of IOX (iex/port forwarding) Tunnel/Proxy Tool via Process Creation

Alerts on Windows process creation for iox.exe with tunneling/proxy forwarding command-line parameters.

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.

Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.

Windows Process Creation: GMER Rootkit Tool Execution (gmer.exe)

Flags execution of gmer.exe on Windows when matched by known process hashes.

Windows hh.exe Initiates HTTP(S) Network Connections

Flags hh.exe starting connections to ports 80/443, which may indicate access to remotely hosted content.

PowerShell PSAsyncShell Reverse Shell Activity via Script Block Logging

Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.