Sigma detection rules, expert-reviewed

Windows: AnyDesk Password Piped via CMD Using --set-password

Alerts on Windows command lines that echo a value and set an AnyDesk password non-interactively via --set-password.

Windows IIS connection string decryption via aspnet_regiis -pdf

Flags aspnet_regiis.exe runs that target IIS connectionStrings for decryption using -pdf.

Windows: conhost.exe spawned by uncommon parent process

Alerts on conhost.exe launched by an uncommon parent process, using process creation parent image and command-line context.

PowerShell ScriptBlock Matching Invoke-Mimikatz Credential Dump Commands (Windows)

Detects PowerShell ScriptBlocks containing Mimikatz-like credential dump and certificate extraction command strings.

AnyDesk Windows: suspicious executable/DLL writes excluding gcapi.dll

Alerts when AnyDesk.exe or AnyDeskMSI.exe writes .dll/.exe files, excluding gcapi.dll.

Windows Process Creation: UAC bypass attempt via MMC Windows Firewall Snap-in hijack

Alerts when MMC launches WF.msc, a possible UAC bypass snap-in hijack pattern, excluding WerFault.exe-related cases.

Windows Process Creation: SSH Port-Forwarding Commands Targeting RDP (3389)

Flags Windows command lines using SSH port-forwarding switches that also reference RDP port :3389.

Windows ImagingDevices.exe Spawns Unusual Parent/Child Processes

Alerts when ImagingDevices.exe participates in atypical process parent/child chains on Windows, based on process creation telemetry.

Windows: Unusual Child Process Spawn by dns.exe

Alerts when dns.exe launches an unexpected child process other than conhost.exe.

Windows desktopimgdownldr.exe Remote File Download via /lockscreenurl:http

Flags desktopimgdownldr.exe executions that specify a remote lockscreen URL via /lockscreenurl:http.

Windows Process Creation: 7-Zip Compressing .dmp/.dump Files

Flags Windows executions of 7-Zip where the command line includes .dmp/.dump/.hdmp extensions.

Windows dns.exe Deletes Files with Unexpected Targets

Alerts when dns.exe deletes any file other than dns.log on Windows.

Windows: Unusual File Modification by dns.exe

Alert on dns.exe changing files other than dns.log, which can indicate suspicious or compromised system activity.

Windows Remote Thread Creation via rundll32 Triggered by wab*, wabmig, or ImagingDevices

Alerts on remote thread creation targeting rundll32.exe from wab* or ImagingDevices.exe process images on Windows.

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Detects PowerShell Send-MailMessage usage with -Attachments, which may indicate SMTP-based data exfiltration.