windows — logsource-product tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• 7Zip Compressing Dump Files · sigma-rule
• A Member Was Added to a Security-Enabled Global Group · sigma-rule
• A Member Was Removed From a Security-Enabled Global Group · sigma-rule
• A New Trust Was Created To A Domain · sigma-rule
• A Rule Has Been Deleted From The Windows Firewall Exception List · sigma-rule
• A Security-Enabled Global Group Was Deleted · sigma-rule
• Abusable DLL Potential Sideloading From Suspicious Location · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service - PS · sigma-rule
• Abused Debug Privilege by Arbitrary Parent Processes · sigma-rule
• Abusing Print Executable · sigma-rule
• Access To ADMIN$ Network Share · sigma-rule
• Access to Browser Login Data · sigma-rule
• Access To Crypto Currency Wallets By Uncommon Applications · sigma-rule
• Access To Potentially Sensitive Sysvol Files By Uncommon Applications · sigma-rule
• Access To Windows Credential History File By Uncommon Applications · sigma-rule
• Access To Windows DPAPI Master Keys By Uncommon Applications · sigma-rule
• Account Tampering - Suspicious Failed Logon Reasons · sigma-rule
• Activate Suppression of Windows Security Center Notifications · sigma-rule
• Active Directory Certificate Services Denied Certificate Enrollment Request · sigma-rule
• Active Directory Computers Enumeration With Get-AdComputer · sigma-rule
• Active Directory Database Snapshot Via ADExplorer · sigma-rule
• Active Directory Group Enumeration With Get-AdGroup · sigma-rule
• Active Directory Replication from Non Machine Account · sigma-rule
• Active Directory Structure Export Via Csvde.EXE · sigma-rule
• Active Directory User Backdoors · sigma-rule
• AD Groups Or Users Enumeration Using PowerShell - PoshModule · sigma-rule
• AD Groups Or Users Enumeration Using PowerShell - ScriptBlock · sigma-rule
• AD Object WriteDAC Access · sigma-rule
• AD Privileged Users or Groups Reconnaissance · sigma-rule
• Add DisallowRun Execution to Registry · sigma-rule
• Add Insecure Download Source To Winget · sigma-rule
• Add New Download Source To Winget · sigma-rule
• Add or Remove Computer from DC · sigma-rule
• Add Port Monitor Persistence in Registry · sigma-rule
• Add Potential Suspicious New Download Source To Winget · sigma-rule
• Add SafeBoot Keys Via Reg Utility · sigma-rule
• AddinUtil.EXE Execution From Uncommon Directory · sigma-rule
• Addition of SID History to Active Directory Object · sigma-rule
• ADExplorer Writing Complete AD Snapshot Into .dat File · sigma-rule
• ADFS Database Named Pipe Connection By Uncommon Tool · sigma-rule
• Admin User Remote Logon · sigma-rule
• ADS Zone.Identifier Deleted By Uncommon Application · sigma-rule
• ADSI-Cache File Creation By Uncommon Tool · sigma-rule
• Advanced IP Scanner - File Event · sigma-rule
• Adwind RAT / JRAT File Artifact · sigma-rule
• AgentExecutor PowerShell Execution · sigma-rule
• All Backups Deleted Via Wbadmin.EXE · sigma-rule
• All Rules Have Been Deleted From The Windows Firewall Configuration · sigma-rule
• Allow RDP Remote Assistance Feature · sigma-rule
• Allow Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Alternate PowerShell Hosts - PowerShell Module · sigma-rule
• Alternate PowerShell Hosts Pipe · sigma-rule
• Always Install Elevated MSI Spawned Cmd And Powershell · sigma-rule
• Always Install Elevated Windows Installer · sigma-rule
• AMSI Bypass Pattern Assembly GetType · sigma-rule
• AMSI Disabled via Registry Modification · sigma-rule
• Antivirus Filter Driver Disallowed On Dev Drive - Registry · sigma-rule
• Anydesk Temporary Artefact · sigma-rule
• Application Removed Via Wmic.EXE · sigma-rule
• Application Termination Attempt via Wmic.EXE · sigma-rule
• Application Uninstalled · sigma-rule
• AppLocker Prevented Application or Script from Running · sigma-rule
• AppX Package Installation Attempts Via AppInstaller.EXE · sigma-rule
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE · sigma-rule
• Arbitrary File Download Via ConfigSecurityPolicy.EXE · sigma-rule
• Arbitrary File Download Via GfxDownloadWrapper.EXE · sigma-rule
• Arbitrary File Download Via IMEWDBLD.EXE · sigma-rule
• Arbitrary File Download Via MSEDGE_PROXY.EXE · sigma-rule
• Arbitrary File Download Via MSOHTMED.EXE · sigma-rule
• Arbitrary File Download Via MSPUB.EXE · sigma-rule
• Arbitrary File Download Via PresentationHost.EXE · sigma-rule
• Arbitrary File Download Via Squirrel.EXE · sigma-rule
• Arbitrary MSI Download Via Devinit.EXE · sigma-rule
• Arbitrary Shell Command Execution Via Settingcontent-Ms · sigma-rule
• Aruba Network Service Potential DLL Sideloading · sigma-rule
• AspNetCompiler Execution · sigma-rule
• Assembly Loading Via CL_LoadAssembly.ps1 · sigma-rule
• Atbroker Registry Change · sigma-rule
• Atera Agent Installation · sigma-rule
• Attempts of Kerberos Coercion Via DNS SPN Spoofing · sigma-rule
• Audio Capture via PowerShell · sigma-rule
• Audio Capture via SoundRecorder · sigma-rule
• Audit CVE Event · sigma-rule
• Audit Policy Tampering Via Auditpol · sigma-rule
• Audit Policy Tampering Via NT Resource Kit Auditpol · sigma-rule
• Automated Collection Bookmarks Using Get-ChildItem PowerShell · sigma-rule
• Automated Collection Command PowerShell · sigma-rule
• Automated Collection Command Prompt · sigma-rule
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl · sigma-rule
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File · sigma-rule
• Azure AD Health Monitoring Agent Registry Keys Access · sigma-rule
• Azure AD Health Service Agents Registry Keys Access · sigma-rule
• BaaUpdate.exe Suspicious DLL Load · sigma-rule
• Backup Catalog Deleted · sigma-rule
• Backup Files Deleted · sigma-rule
• Bad Opsec Defaults Sacrificial Processes With Improper Arguments · sigma-rule
• Bad Opsec Powershell Code Artifacts · sigma-rule
• Base64 Encoded PowerShell Command Detected · sigma-rule
• Binary Proxy Execution Via Dotnet-Trace.EXE · sigma-rule
• BitLockerTogo.EXE Execution · sigma-rule
• BITS Transfer Job Download From Direct IP · sigma-rule
• BITS Transfer Job Download From File Sharing Domains · sigma-rule
• BITS Transfer Job Download To Potential Suspicious Folder · sigma-rule
• BITS Transfer Job Downloading File Potential Suspicious Extension · sigma-rule
• BITS Transfer Job With Uncommon Or Suspicious Remote TLD · sigma-rule
• BloodHound Collection Files · sigma-rule
• Boot Configuration Tampering Via Bcdedit.EXE · sigma-rule
• Browser Execution In Headless Mode · sigma-rule
• Browser Started with Remote Debugging · sigma-rule
• Bypass UAC Using DelegateExecute · sigma-rule
• Bypass UAC Using Event Viewer · sigma-rule
• Bypass UAC Using SilentCleanup Task · sigma-rule
• Bypass UAC via CMSTP · sigma-rule
• Bypass UAC via Fodhelper.exe · sigma-rule
• Bypass UAC via WSReset.exe · sigma-rule
• C# IL Code Compilation Via Ilasm.EXE · sigma-rule
• Capture Credentials with Rpcping.exe · sigma-rule
• Certificate Exported From Local Certificate Store · sigma-rule
• Certificate Exported Via Certutil.EXE · sigma-rule
• Certificate Exported Via PowerShell · sigma-rule
• Certificate Exported Via PowerShell - ScriptBlock · sigma-rule
• Certificate Private Key Acquired · sigma-rule
• Certificate Request Export to Exchange Webserver · sigma-rule
• Change Default File Association To Executable Via Assoc · sigma-rule
• Change Default File Association Via Assoc · sigma-rule
• Change PowerShell Policies to an Insecure Level · sigma-rule
• Change PowerShell Policies to an Insecure Level - PowerShell · sigma-rule
• Change the Fax Dll · sigma-rule
• Change User Account Associated with the FAX Service · sigma-rule
• Change User Agents with WebRequest · sigma-rule
• Change Winevt Channel Access Permission Via Registry · sigma-rule
• Changing Existing Service ImagePath Value Via Reg.EXE · sigma-rule
• Chopper Webshell Process Pattern · sigma-rule
• Chromium Browser Instance Executed With Custom Extension · sigma-rule
• Classes Autorun Keys Modification · sigma-rule
• Clear PowerShell History - PowerShell · sigma-rule
• Clear PowerShell History - PowerShell Module · sigma-rule
• Clearing Windows Console History · sigma-rule
• Clfs.SYS Loaded By Process Located In a Potential Suspicious Location · sigma-rule
• ClickOnce Trust Prompt Tampering · sigma-rule
• Cloudflared Portable Execution · sigma-rule
• Cloudflared Quick Tunnel Execution · sigma-rule
• Cloudflared Tunnel Connections Cleanup · sigma-rule
• Cloudflared Tunnel Execution · sigma-rule
• Cloudflared Tunnels Related DNS Requests · sigma-rule
• CLR DLL Loaded Via Office Applications · sigma-rule
• Cmd Launched with Hidden Start Flags to Suspicious Targets · sigma-rule
• Cmd.EXE Missing Space Characters Execution Anomaly · sigma-rule
• CMSTP Execution Process Access · sigma-rule
• CMSTP Execution Process Creation · sigma-rule
• CMSTP Execution Registry Event · sigma-rule
• CMSTP UAC Bypass via COM Object Access · sigma-rule
• CobaltStrike Load by Rundll32 · sigma-rule
• CobaltStrike Named Pipe · sigma-rule
• CobaltStrike Named Pipe Pattern Regex · sigma-rule
• CobaltStrike Named Pipe Patterns · sigma-rule
• CobaltStrike Service Installations - Security · sigma-rule
• CobaltStrike Service Installations - System · sigma-rule
• Code Executed Via Office Add-in XLL File · sigma-rule
• Code Execution via Pcwutl.dll · sigma-rule
• CodeIntegrity - Blocked Driver Load With Revoked Certificate · sigma-rule
• CodeIntegrity - Blocked Image/Driver Load For Policy Violation · sigma-rule
• CodePage Modification Via MODE.COM To Russian Language · sigma-rule
• COM Hijack via Sdclt · sigma-rule
• COM Hijacking via TreatAs · sigma-rule
• COM Object Execution via Xwizard.EXE · sigma-rule
• COM Object Hijacking Via Modification Of Default System CLSID Default Value · sigma-rule
• Command Line Execution with Suspicious URL and AppData Strings · sigma-rule
• Common Autorun Keys Modification · sigma-rule
• Communication To LocaltoNet Tunneling Service Initiated · sigma-rule
• Communication To Ngrok Tunneling Service Initiated · sigma-rule
• Communication To Uncommon Destination Ports · sigma-rule
• Compress Data and Lock With Password for Exfiltration With 7-ZIP · sigma-rule
• Compress Data and Lock With Password for Exfiltration With WINZIP · sigma-rule
• Compressed File Creation Via Tar.EXE · sigma-rule
• Compressed File Extraction Via Tar.EXE · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell · sigma-rule
• Computer System Reconnaissance Via Wmic.EXE · sigma-rule
• Conhost Spawned By Uncommon Parent Process · sigma-rule
• Conhost.exe CommandLine Path Traversal · sigma-rule
• Console CodePage Lookup Via CHCP · sigma-rule
• Control Panel Items · sigma-rule
• ConvertTo-SecureString Cmdlet Usage Via CommandLine · sigma-rule
• Copy From Or To Admin Share Or Sysvol Folder · sigma-rule
• Copy From VolumeShadowCopy Via Cmd.EXE · sigma-rule
• Copying Sensitive Files with Credential Data · sigma-rule
• Crash Dump Created By Operating System · sigma-rule
• CrashControl CrashDump Disabled · sigma-rule
• Create Volume Shadow Copy with Powershell · sigma-rule
• Created Files by Microsoft Sync Center · sigma-rule
• CreateDump Process Dump · sigma-rule
• Creation Exe for Service with Unquoted Path · sigma-rule
• Creation of a Local Hidden User Account by Registry · sigma-rule
• Creation Of Non-Existent System DLL · sigma-rule
• Creation of WerFault.exe/Wer.dll in Unusual Folder · sigma-rule
• Cred Dump Tools Dropped Files · sigma-rule
• Credential Dumping Activity By Python Based Tool · sigma-rule
• Credential Dumping Attempt Via Svchost · sigma-rule
• Credential Dumping Attempt Via WerFault · sigma-rule
• Credential Dumping Tools Service Execution - Security · sigma-rule
• Credential Dumping Tools Service Execution - System · sigma-rule
• Credential Manager Access By Uncommon Applications · sigma-rule
• CredUI.DLL Loaded By Uncommon Process · sigma-rule
• Critical Hive In Suspicious Location Access Bits Cleared · sigma-rule
• Csc.EXE Execution Form Potentially Suspicious Parent · sigma-rule
• Cscript/Wscript Uncommon Script Extension Execution · sigma-rule
• CSExec Service File Creation · sigma-rule
• CSExec Service Installation · sigma-rule
• Curl Download And Execute Combination · sigma-rule
• Curl File Upload To File Sharing Websites · sigma-rule
• CurrentControlSet Autorun Keys Modification · sigma-rule
• CurrentVersion Autorun Keys Modification · sigma-rule
• CurrentVersion NT Autorun Keys Modification · sigma-rule
• Custom File Open Handler Executes PowerShell · sigma-rule
• Data Copied To Clipboard Via Clip.EXE · sigma-rule
• Data Export From MSSQL Table Via BCP.EXE · sigma-rule
• DCERPC SMB Spoolss Named Pipe · sigma-rule
• DCOM InternetExplorer.Application Iertutil DLL Hijack - Security · sigma-rule
• Default RDP Port Changed to Non Standard Port · sigma-rule
• Delete All Scheduled Tasks · sigma-rule
• Delete Important Scheduled Task · sigma-rule
• Delete Volume Shadow Copies Via WMI With PowerShell · sigma-rule
• Deleted Data Overwritten Via Cipher.EXE · sigma-rule
• Deletion of Volume Shadow Copies via WMI with PowerShell · sigma-rule
• Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script · sigma-rule
• Denied Access To Remote Desktop · sigma-rule
• Deno Runtime Spawns Shell Or Scripting Interpreter · sigma-rule
• Deny Service Access Using Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Desktop.INI Created by Uncommon Process · sigma-rule
• Detected Windows Software Discovery · sigma-rule
• Detected Windows Software Discovery - PowerShell · sigma-rule
• Detection of PowerShell Execution via Sqlps.exe · sigma-rule
• Devcon Execution Disabling VMware VMCI Device · sigma-rule
• Device Installation Blocked · sigma-rule
• DeviceCredentialDeployment Execution · sigma-rule
• Devtoolslauncher.exe Executes Specified Binary · sigma-rule
• DHCP Callout DLL Installation · sigma-rule
• DHCP Server Error Failed Loading the CallOut DLL · sigma-rule
• DHCP Server Loaded the CallOut DLL · sigma-rule
• Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE · sigma-rule
• Direct Autorun Keys Modification · sigma-rule
• Directory Removal Via Rmdir · sigma-rule
• Directory Service Restore Mode(DSRM) Registry Value Tampering · sigma-rule
• DirectorySearcher Powershell Exploitation · sigma-rule
• DirLister Execution · sigma-rule
• Disable Administrative Share Creation at Startup · sigma-rule
• Disable Exploit Guard Network Protection on Windows Defender · sigma-rule
• Disable Important Scheduled Task · sigma-rule
• Disable Internal Tools or Feature in Registry · sigma-rule
• Disable Microsoft Defender Firewall via Registry · sigma-rule
• Disable of ETW Trace - Powershell · sigma-rule
• Disable Powershell Command History · sigma-rule
• Disable Privacy Settings Experience in Registry · sigma-rule
• Disable PUA Protection on Windows Defender · sigma-rule
• Disable Security Events Logging Adding Reg Key MiniNt · sigma-rule
• Disable Tamper Protection on Windows Defender · sigma-rule
• Disable Windows Defender AV Security Monitoring · sigma-rule
• Disable Windows Defender Functionalities Via Registry Keys · sigma-rule
• Disable Windows Event Logging Via Registry · sigma-rule
• Disable Windows Firewall by Registry · sigma-rule
• Disable Windows IIS HTTP Logging · sigma-rule
• Disable Windows Security Center Notifications · sigma-rule
• Disable-WindowsOptionalFeature Command PowerShell · sigma-rule
• Disabled IE Security Features · sigma-rule
• Disabled Volume Snapshots · sigma-rule
• Disabled Windows Defender Eventlog · sigma-rule
• Disabling Windows Defender WMI Autologger Session via Reg.exe · sigma-rule
• Discovery of a System Time · sigma-rule
• Diskshadow Script Mode - Execution From Potential Suspicious Location · sigma-rule
• Diskshadow Script Mode - Uncommon Script Extension Execution · sigma-rule
• Dism Remove Online Package · sigma-rule
• Displaying Hidden Files Feature Disabled · sigma-rule
• DLL Execution via Rasautou.exe · sigma-rule
• DLL Execution Via Register-cimprovider.exe · sigma-rule
• DLL Load By System Process From Suspicious Locations · sigma-rule
• DLL Load via LSASS · sigma-rule
• DLL Loaded From Suspicious Location Via Cmspt.EXE · sigma-rule
• DLL Loaded via CertOC.EXE · sigma-rule
• DLL Search Order Hijackig Via Additional Space in Path · sigma-rule
• DLL Sideloading by VMware Xfer Utility · sigma-rule
• DLL Sideloading Of ShellChromeAPI.DLL · sigma-rule
• Dllhost.EXE Execution Anomaly · sigma-rule
• DllUnregisterServer Function Call Via Msiexec.EXE · sigma-rule
• DMSA Link Attributes Modified · sigma-rule
• DMSA Service Account Created in Specific OUs - PowerShell · sigma-rule
• DNS Exfiltration and Tunneling Tools Execution · sigma-rule
• DNS HybridConnectionManager Service Bus · sigma-rule
• DNS Query by Finger Utility · sigma-rule
• DNS Query for Anonfiles.com Domain - DNS Client · sigma-rule
• DNS Query for Anonfiles.com Domain - Sysmon · sigma-rule
• DNS Query Request By QuickAssist.EXE · sigma-rule
• DNS Query Request By Regsvr32.EXE · sigma-rule
• DNS Query Request To OneLaunch Update Service · sigma-rule
• DNS Query To AzureWebsites.NET By Non-Browser Process · sigma-rule
• DNS Query To Common Malware Hosting and Shortener Services · sigma-rule
• DNS Query To Devtunnels Domain · sigma-rule
• DNS Query To MEGA Hosting Website · sigma-rule
• DNS Query To MEGA Hosting Website - DNS Client · sigma-rule
• DNS Query To Remote Access Software Domain From Non-Browser App · sigma-rule
• DNS Query To Ufile.io · sigma-rule
• DNS Query To Ufile.io - DNS Client · sigma-rule
• DNS Query To Visual Studio Code Tunnels Domain · sigma-rule
• DNS Query Tor .Onion Address - Sysmon · sigma-rule
• DNS Server Discovery Via LDAP Query · sigma-rule
• DNS Server Error Failed Loading the ServerLevelPluginDLL · sigma-rule
• DNS-over-HTTPS Enabled by Registry · sigma-rule
• Domain Trust Discovery Via Dsquery · sigma-rule
• DotNET Assembly DLL Loaded Via Office Application · sigma-rule
• DotNet CLR DLL Loaded By Scripting Applications · sigma-rule
• DPAPI Backup Keys And Certificate Export Activity IOC · sigma-rule
• DPAPI Domain Backup Key Extraction · sigma-rule
• DPAPI Domain Master Key Backup Attempt · sigma-rule
• Driver Load From A Temporary Directory · sigma-rule
• Driver/DLL Installation Via Odbcconf.EXE · sigma-rule
• Dropping Of Password Filter DLL · sigma-rule
• DSInternals Suspicious PowerShell Cmdlets · sigma-rule
• DSInternals Suspicious PowerShell Cmdlets - ScriptBlock · sigma-rule
• Dump Credentials from Windows Credential Manager With PowerShell · sigma-rule
• Dumping of Sensitive Hives Via Reg.EXE · sigma-rule
• Dumping Process via Sqldumper.exe · sigma-rule
• DumpMinitool Execution · sigma-rule
• Dynamic .NET Compilation Via Csc.EXE · sigma-rule
• Dynamic CSharp Compile Artefact · sigma-rule
• Elevated System Shell Spawned From Uncommon Parent Location · sigma-rule
• Enable LM Hash Storage · sigma-rule
• Enable LM Hash Storage - ProcCreation · sigma-rule
• Enable Microsoft Dynamic Data Exchange · sigma-rule
• Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback · sigma-rule
• Enable Windows Remote Management · sigma-rule
• Enabled User Right in AD to Control User Objects · sigma-rule
• Enabling COR Profiler Environment Variables · sigma-rule
• Enumerate All Information With Whoami.EXE · sigma-rule
• Enumerate Credentials from Windows Credential Manager With PowerShell · sigma-rule
• Enumeration for 3rd Party Creds From CLI · sigma-rule
• Enumeration for Credentials in Registry · sigma-rule
• Esentutl Gather Credentials · sigma-rule
• Esentutl Steals Browser Information · sigma-rule
• Esentutl Volume Shadow Copy Service Keys · sigma-rule
• ETW Logging Disabled For rpcrt4.dll · sigma-rule
• ETW Logging Disabled For SCM · sigma-rule
• ETW Logging Disabled In .NET Processes - Registry · sigma-rule
• ETW Logging Disabled In .NET Processes - Sysmon Registry · sigma-rule
• ETW Logging Tamper In .NET Processes Via CommandLine · sigma-rule
• ETW Logging/Processing Option Disabled On IIS Server · sigma-rule
• ETW Trace Evasion Activity · sigma-rule
• Eventlog Cleared · sigma-rule
• EventLog EVTX File Deleted · sigma-rule
• EVTX Created In Uncommon Location · sigma-rule
• Exchange PowerShell Cmdlet History Deleted · sigma-rule
• Exchange PowerShell Snap-Ins Usage · sigma-rule
• Exchange Set OabVirtualDirectory ExternalUrl Property · sigma-rule
• Execute Code with Pester.bat · sigma-rule
• Execute Code with Pester.bat as Parent · sigma-rule
• Execute Files with Msdeploy.exe · sigma-rule
• Execute From Alternate Data Streams · sigma-rule
• Execute Invoke-command on Remote Host · sigma-rule
• Execute Pcwrun.EXE To Leverage Follina · sigma-rule
• Execution DLL of Choice Using WAB.EXE · sigma-rule
• Execution of Powershell Script in Public Folder · sigma-rule
• Execution via stordiag.exe · sigma-rule
• Execution via WorkFolders.exe · sigma-rule
• Explorer NOUACCHECK Flag · sigma-rule
• Explorer Process Tree Break · sigma-rule
• Exports Critical Registry Keys To a File · sigma-rule
• Exports Registry Key To a File · sigma-rule
• Exports Registry Key To an Alternate Data Stream · sigma-rule
• External Disk Drive Or USB Storage Device Was Recognized By The System · sigma-rule
• External Remote RDP Logon from Public IP · sigma-rule
• External Remote SMB Logon from Public IP · sigma-rule
• Extracting Information with PowerShell · sigma-rule
• Failed Code Integrity Checks · sigma-rule
• Failed DNS Zone Transfer · sigma-rule
• Failed Logon From Public IP · sigma-rule
• Failed MSExchange Transport Agent Installation · sigma-rule
• Fax Service DLL Search Order Hijack · sigma-rule
• File Access Of Signal Desktop Sensitive Data · sigma-rule
• File And SubFolder Enumeration Via Dir Command · sigma-rule
• File Creation In Suspicious Directory By Msdt.EXE · sigma-rule
• File Decoded From Base64/Hex Via Certutil.EXE · sigma-rule
• File Deleted Via Sysinternals SDelete · sigma-rule
• File Deletion Via Del · sigma-rule
• File Download And Execution Via IEExec.EXE · sigma-rule
• File Download From Browser Process Via Inline URL · sigma-rule
• File Download From IP Based URL Via CertOC.EXE · sigma-rule
• File Download Using Notepad++ GUP Utility · sigma-rule
• File Download Using ProtocolHandler.exe · sigma-rule
• File Download Via Bitsadmin · sigma-rule
• File Download Via Bitsadmin To A Suspicious Target Folder · sigma-rule
• File Download via CertOC.EXE · sigma-rule
• File Download Via InstallUtil.EXE · sigma-rule
• File Download Via Windows Defender MpCmpRun.EXE · sigma-rule
• File Download with Headless Browser · sigma-rule
• File Encoded To Base64 Via Certutil.EXE · sigma-rule
• File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell · sigma-rule
• File In Suspicious Location Encoded To Base64 Via Certutil.EXE · sigma-rule
• File Recovery From Backup Via Wbadmin.EXE · sigma-rule
• File With Suspicious Extension Downloaded Via Bitsadmin · sigma-rule
• File With Uncommon Extension Created By An Office Application · sigma-rule
• FileFix - Command Evidence in TypedPaths · sigma-rule
• Files Added To An Archive Using Rar.EXE · sigma-rule
• Files With System DLL Name In Unsuspected Locations · sigma-rule
• Files With System Process Name In Unsuspected Locations · sigma-rule
• Filter Driver Unloaded Via Fltmc.EXE · sigma-rule
• Findstr GPP Passwords · sigma-rule
• Findstr Launching .lnk File · sigma-rule
• Finger.EXE Execution · sigma-rule
• Firewall Configuration Discovery Via Netsh.EXE · sigma-rule
• Firewall Disabled via Netsh.EXE · sigma-rule
• Firewall Rule Deleted Via Netsh.EXE · sigma-rule
• First Time Seen Remote Named Pipe · sigma-rule
• Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet · sigma-rule
• Folder Removed From Exploit Guard ProtectedFolders List - Registry · sigma-rule
• Forfiles Command Execution · sigma-rule
• Forfiles.EXE Child Process Masquerading · sigma-rule
• Fsutil Drive Enumeration · sigma-rule
• Fsutil Suspicious Invocation · sigma-rule
• Function Call From Undocumented COM Interface EditionUpgradeManager · sigma-rule
• GAC DLL Loaded Via Office Applications · sigma-rule
• Get-ADUser Enumeration Using UserAccountControl Flags · sigma-rule
• Github Self-Hosted Runner Execution · sigma-rule
• GoToAssist Temporary Installation Artefact · sigma-rule
• Gpresult Display Group Policy Information · sigma-rule
• Gpscript Execution · sigma-rule
• Greedy File Deletion Using Del · sigma-rule
• Group Membership Reconnaissance Via Whoami.EXE · sigma-rule
• Group Policy Abuse for Privilege Addition · sigma-rule
• Gzip Archive Decode Via PowerShell · sigma-rule
• HackTool - ADCSPwn Execution · sigma-rule
• HackTool - Bloodhound/Sharphound Execution · sigma-rule
• HackTool - CACTUSTORCH Remote Thread Creation · sigma-rule
• HackTool - Certify Execution · sigma-rule
• HackTool - Certipy Execution · sigma-rule
• HackTool - CobaltStrike BOF Injection Pattern · sigma-rule
• HackTool - CoercedPotato Execution · sigma-rule
• HackTool - CoercedPotato Named Pipe Creation · sigma-rule
• HackTool - Covenant PowerShell Launcher · sigma-rule
• HackTool - CrackMapExec Execution · sigma-rule
• HackTool - CrackMapExec Execution Patterns · sigma-rule
• HackTool - CrackMapExec File Indicators · sigma-rule
• HackTool - CrackMapExec PowerShell Obfuscation · sigma-rule
• HackTool - CrackMapExec Process Patterns · sigma-rule
• HackTool - CreateMiniDump Execution · sigma-rule
• HackTool - Credential Dumping Tools Named Pipe Created · sigma-rule
• HackTool - Default PowerSploit/Empire Scheduled Task Creation · sigma-rule
• HackTool - DInjector PowerShell Cradle Execution · sigma-rule
• HackTool - Doppelanger LSASS Dumper Execution · sigma-rule
• HackTool - Dumpert Process Dumper Default File · sigma-rule
• HackTool - Dumpert Process Dumper Execution · sigma-rule
• Hacktool - EDR-Freeze Execution · sigma-rule
• HackTool - EDRSilencer Execution · sigma-rule
• HackTool - EDRSilencer Execution - Filter Added · sigma-rule
• HackTool - EfsPotato Named Pipe Creation · sigma-rule
• HackTool - Empire PowerShell Launch Parameters · sigma-rule
• HackTool - Empire PowerShell UAC Bypass · sigma-rule
• HackTool - F-Secure C3 Load by Rundll32 · sigma-rule
• HackTool - Generic Process Access · sigma-rule
• HackTool - HandleKatz Duplicating LSASS Handle · sigma-rule
• HackTool - HandleKatz LSASS Dumper Execution · sigma-rule
• HackTool - Hashcat Password Cracker Execution · sigma-rule
• HackTool - HollowReaper Execution · sigma-rule
• HackTool - Htran/NATBypass Execution · sigma-rule
• HackTool - Hydra Password Bruteforce Execution · sigma-rule
• HackTool - Impacket File Indicators · sigma-rule
• HackTool - Impacket Tools Execution · sigma-rule
• HackTool - Impersonate Execution · sigma-rule
• HackTool - Inveigh Execution · sigma-rule
• HackTool - Inveigh Execution Artefacts · sigma-rule
• HackTool - Jlaive In-Memory Assembly Execution · sigma-rule
• HackTool - Koadic Execution · sigma-rule
• HackTool - Koh Default Named Pipe · sigma-rule
• HackTool - KrbRelay Execution · sigma-rule
• HackTool - KrbRelayUp Execution · sigma-rule
• HackTool - LittleCorporal Generated Maldoc Injection · sigma-rule
• HackTool - Mimikatz Execution · sigma-rule
• HackTool - Mimikatz Kirbi File Creation · sigma-rule
• HackTool - NetExec Execution · sigma-rule
• HackTool - NetExec File Indicators · sigma-rule
• HackTool - NoFilter Execution · sigma-rule
• HackTool - PCHunter Execution · sigma-rule
• HackTool - Potential CobaltStrike Process Injection · sigma-rule
• HackTool - Potential Impacket Lateral Movement Activity · sigma-rule
• HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump · sigma-rule
• HackTool - PowerTool Execution · sigma-rule
• HackTool - Powerup Write Hijack DLL · sigma-rule
• HackTool - PPID Spoofing SelectMyParent Tool Execution · sigma-rule
• HackTool - PurpleSharp Execution · sigma-rule
• HackTool - Pypykatz Credentials Dumping Activity · sigma-rule
• HackTool - Quarks PwDump Execution · sigma-rule
• HackTool - QuarksPwDump Dump File · sigma-rule
• HackTool - RedMimicry Winnti Playbook Execution · sigma-rule
• HackTool - RemoteKrbRelay Execution · sigma-rule
• HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators · sigma-rule
• HackTool - Rubeus Execution · sigma-rule
• HackTool - Rubeus Execution - ScriptBlock · sigma-rule
• HackTool - SafetyKatz Dump Indicator · sigma-rule
• HackTool - SafetyKatz Execution · sigma-rule
• HackTool - SecurityXploded Execution · sigma-rule
• HackTool - SharpChisel Execution · sigma-rule
• HackTool - SharpDPAPI Execution · sigma-rule
• HackTool - SharPersist Execution · sigma-rule
• HackTool - SharpEvtMute DLL Load · sigma-rule
• HackTool - SharpEvtMute Execution · sigma-rule
• HackTool - SharpImpersonation Execution · sigma-rule
• HackTool - SharpLdapWhoami Execution · sigma-rule
• HackTool - SharpMove Tool Execution · sigma-rule
• HackTool - SharpUp PrivEsc Tool Execution · sigma-rule
• HackTool - SharpView Execution · sigma-rule
• HackTool - SharpWSUS/WSUSpendu Execution · sigma-rule
• HackTool - SILENTTRINITY Stager DLL Load · sigma-rule
• HackTool - SILENTTRINITY Stager Execution · sigma-rule
• HackTool - Sliver C2 Implant Activity Pattern · sigma-rule
• HackTool - SOAPHound Execution · sigma-rule
• HackTool - Stracciatella Execution · sigma-rule
• HackTool - SysmonEnte Execution · sigma-rule
• HackTool - SysmonEOP Execution · sigma-rule
• HackTool - TruffleSnout Execution · sigma-rule
• HackTool - Typical HiveNightmare SAM File Export · sigma-rule
• HackTool - UACMe Akagi Execution · sigma-rule
• HackTool - Windows Credential Editor (WCE) Execution · sigma-rule
• HackTool - winPEAS Execution · sigma-rule
• HackTool - WinPwn Execution · sigma-rule
• HackTool - WinPwn Execution - ScriptBlock · sigma-rule
• HackTool - WinRM Access Via Evil-WinRM · sigma-rule
• HackTool - WSASS Execution · sigma-rule
• HackTool - XORDump Execution · sigma-rule
• Hacktool Execution - Imphash · sigma-rule
• Hacktool Execution - PE Metadata · sigma-rule
• HackTool Named File Stream Created · sigma-rule
• Hacktool Ruler · sigma-rule
• HackTool Service Registration or Execution · sigma-rule
• Hardware Model Reconnaissance Via Wmic.EXE · sigma-rule
• Harvesting Of Wifi Credentials Via Netsh.EXE · sigma-rule
• HH.EXE Execution · sigma-rule
• Hidden Executable In NTFS Alternate Data Stream · sigma-rule
• Hidden Local User Creation · sigma-rule
• Hidden Powershell in Link File Pattern · sigma-rule
• Hide Schedule Task Via Index Value Tamper · sigma-rule
• Hiding Files with Attrib.exe · sigma-rule
• Hiding User Account Via SpecialAccounts Registry Key · sigma-rule
• Hiding User Account Via SpecialAccounts Registry Key - CommandLine · sigma-rule
• Hijack Legit RDP Session to Move Laterally · sigma-rule
• HKTL - SharpSuccessor Privilege Escalation Tool Execution · sigma-rule
• HTML Help HH.EXE Suspicious Child Process · sigma-rule
• HTTP Logging Disabled On IIS Server · sigma-rule
• HybridConnectionManager Service Installation · sigma-rule
• HybridConnectionManager Service Installation - Registry · sigma-rule
• HybridConnectionManager Service Running · sigma-rule
• Hypervisor Enforced Paging Translation Disabled · sigma-rule
• Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine · sigma-rule
• IE Change Domain Zone · sigma-rule
• Ie4uinit Lolbin Use From Invalid Path · sigma-rule
• IIS Native-Code Module Command Line Installation · sigma-rule
• IIS WebServer Access Logs Deleted · sigma-rule
• IIS WebServer Log Deletion via CommandLine Utilities · sigma-rule
• Impacket PsExec Execution · sigma-rule
• Import LDAP Data Interchange Format File Via Ldifde.EXE · sigma-rule
• Import PowerShell Modules From Suspicious Directories · sigma-rule
• Import PowerShell Modules From Suspicious Directories - ProcCreation · sigma-rule
• Important Scheduled Task Deleted or Disabled · sigma-rule
• Important Scheduled Task Deleted/Disabled · sigma-rule
• Important Windows Event Auditing Disabled · sigma-rule
• Important Windows Eventlog Cleared · sigma-rule
• Imports Registry Key From a File · sigma-rule
• Imports Registry Key From an ADS · sigma-rule
• Indirect Command Execution By Program Compatibility Wizard · sigma-rule
• Indirect Command Execution From Script File Via Bash.EXE · sigma-rule
• Indirect Command Execution via SFTP ProxyCommand · sigma-rule
• Indirect Inline Command Execution Via Bash.EXE · sigma-rule
• InfDefaultInstall.exe .inf Execution · sigma-rule
• Insensitive Subfolder Search Via Findstr.EXE · sigma-rule
• Install New Package Via Winget Local Manifest · sigma-rule
• Installation of TeamViewer Desktop · sigma-rule
• Installation of WSL Kali-Linux · sigma-rule
• Interactive AT Job · sigma-rule
• Interesting Service Enumeration Via Sc.EXE · sigma-rule
• Internet Explorer Autorun Keys Modification · sigma-rule
• Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - PowerShell · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - Security · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - System · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - System · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - Security · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - System · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - Security · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - System · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - Powershell · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - Security · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - System · sigma-rule
• Invoke-Obfuscation VAR+ Launcher · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - PowerShell · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - Security · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - System · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System · sigma-rule
• Invoke-Obfuscation Via Stdin · sigma-rule
• Invoke-Obfuscation Via Stdin - Powershell · sigma-rule
• Invoke-Obfuscation Via Stdin - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Stdin - Security · sigma-rule
• Invoke-Obfuscation Via Stdin - System · sigma-rule
• Invoke-Obfuscation Via Use Clip · sigma-rule
• Invoke-Obfuscation Via Use Clip - Powershell · sigma-rule
• Invoke-Obfuscation Via Use Clip - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use Clip - Security · sigma-rule
• Invoke-Obfuscation Via Use Clip - System · sigma-rule
• Invoke-Obfuscation Via Use MSHTA · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - PowerShell · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - Security · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - System · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - PowerShell · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - Security · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - System · sigma-rule
• ISATAP Router Address Was Set · sigma-rule
• ISO File Created Within Temp Folders · sigma-rule
• ISO Image Mounted · sigma-rule
• ISO or Image Mount Indicator in Recent Files · sigma-rule
• Java Running with Remote Debugging · sigma-rule
• JScript Compiler Execution · sigma-rule
• Kavremover Dropped Binary LOLBIN Usage · sigma-rule
• Kerberoasting Activity - Initial Query · sigma-rule
• Kerberos Manipulation · sigma-rule
• KrbRelayUp Service Installation · sigma-rule
• Launch-VsDevShell.PS1 Proxy Execution · sigma-rule
• Legitimate Application Dropped Archive · sigma-rule
• Legitimate Application Dropped Executable · sigma-rule
• Legitimate Application Dropped Script · sigma-rule
• Legitimate Application Writing Files In Uncommon Location · sigma-rule
• Live Memory Dump Using Powershell · sigma-rule
• Load Of RstrtMgr.DLL By A Suspicious Process · sigma-rule
• Load Of RstrtMgr.DLL By An Uncommon Process · sigma-rule
• Loaded Module Enumeration Via Tasklist.EXE · sigma-rule
• Local Accounts Discovery · sigma-rule
• Local Groups Reconnaissance Via Wmic.EXE · sigma-rule
• Local Network Connection Initiated By Script Interpreter · sigma-rule
• Local Privilege Escalation Indicator TabTip · sigma-rule
• Local User Creation · sigma-rule
• LOL-Binary Copied From System Directory · sigma-rule
• LOLBAS Data Exfiltration by DataSvcUtil.exe · sigma-rule
• Lolbas OneDriveStandaloneUpdater.exe Proxy Download · sigma-rule
• Lolbin Runexehelper Use As Proxy · sigma-rule
• Lolbin Unregmp2.exe Use As Proxy · sigma-rule
• LSA PPL Protection Setting Modification via CommandLine · sigma-rule
• LSASS Access Detected via Attack Surface Reduction · sigma-rule
• LSASS Access From Non System Account · sigma-rule
• LSASS Access From Potentially White-Listed Processes · sigma-rule
• LSASS Dump Keyword In CommandLine · sigma-rule
• Lsass Full Dump Request Via DumpType Registry Settings · sigma-rule
• LSASS Memory Access by Tool With Dump Keyword In Name · sigma-rule
• Lsass Memory Dump via Comsvcs DLL · sigma-rule
• LSASS Process Crashed - Application · sigma-rule
• LSASS Process Dump Artefact In CrashDumps Folder · sigma-rule
• LSASS Process Memory Dump Creation Via Taskmgr.EXE · sigma-rule
• LSASS Process Memory Dump Files · sigma-rule
• LSASS Process Reconnaissance Via Findstr.EXE · sigma-rule
• Macro Enabled In A Potentially Suspicious Document · sigma-rule
• Mailbox Export to Exchange Webserver · sigma-rule
• Malicious Base64 Encoded PowerShell Keywords in Command Lines · sigma-rule
• Malicious DLL File Dropped in the Teams or OneDrive Folder · sigma-rule
• Malicious Driver Load · sigma-rule
• Malicious Driver Load By Name · sigma-rule
• Malicious Named Pipe Created · sigma-rule
• Malicious Nishang PowerShell Commandlets · sigma-rule
• Malicious PE Execution by Microsoft Visual Studio Debugger · sigma-rule
• Malicious PowerShell Commandlets - PoshModule · sigma-rule
• Malicious PowerShell Commandlets - ProcessCreation · sigma-rule
• Malicious PowerShell Commandlets - ScriptBlock · sigma-rule
• Malicious PowerShell Keywords · sigma-rule
• Malicious PowerShell Scripts - FileCreation · sigma-rule
• Malicious PowerShell Scripts - PoshModule · sigma-rule
• Malicious ShellIntel PowerShell Commandlets · sigma-rule
• Malicious Windows Script Components File Execution by TAEF Detection · sigma-rule
• ManageEngine Endpoint Central Dctask64.EXE Potential Abuse · sigma-rule
• Manipulation of User Computer or Group Security Principals Across AD · sigma-rule
• Mavinject Inject DLL Into Running Process · sigma-rule
• MaxMpxCt Registry Value Changed · sigma-rule
• Mesh Agent Service Installation · sigma-rule
• Metasploit Or Impacket Service Installation Via SMB PsExec · sigma-rule
• Metasploit SMB Authentication · sigma-rule
• Meterpreter or Cobalt Strike Getsystem Service Installation - Security · sigma-rule
• Meterpreter or Cobalt Strike Getsystem Service Installation - System · sigma-rule
• Microsoft Defender Blocked from Loading Unsigned DLL · sigma-rule
• Microsoft Defender Tamper Protection Trigger · sigma-rule
• Microsoft Excel Add-In Loaded From Uncommon Location · sigma-rule
• Microsoft IIS Connection Strings Decryption · sigma-rule
• Microsoft IIS Service Account Password Dumped · sigma-rule
• Microsoft Malware Protection Engine Crash · sigma-rule
• Microsoft Malware Protection Engine Crash - WER · sigma-rule
• Microsoft Office DLL Sideload · sigma-rule
• Microsoft Office Protected View Disabled · sigma-rule
• Microsoft Sync Center Suspicious Network Connections · sigma-rule
• Microsoft Teams Sensitive File Access By Uncommon Applications · sigma-rule
• Microsoft VBA For Outlook Addin Loaded Via Outlook · sigma-rule
• Mimikatz DC Sync · sigma-rule
• Mimikatz Use · sigma-rule
• MMC Executing Files with Reversed Extensions Using RTLO Abuse · sigma-rule
• MMC Loading Script Engines DLLs · sigma-rule
• MMC Spawning Windows Shell · sigma-rule
• MMC20 Lateral Movement · sigma-rule
• Modification of IE Registry Settings · sigma-rule
• Modify Group Policy Settings · sigma-rule
• Modify Group Policy Settings - ScriptBlockLogging · sigma-rule
• Modify User Shell Folders Startup Value · sigma-rule
• Monitoring For Persistence Via BITS · sigma-rule
• Moriya Rootkit - System · sigma-rule
• MpiExec Lolbin · sigma-rule
• MSDT Execution Via Answer File · sigma-rule
• MSExchange Transport Agent Installation · sigma-rule
• MSExchange Transport Agent Installation - Builtin · sigma-rule
• MSHTA Execution with Suspicious File Extensions · sigma-rule
• MSI Installation From Web · sigma-rule
• Msiexec Quiet Installation · sigma-rule
• MsiExec Web Install · sigma-rule
• MSSQL Destructive Query · sigma-rule
• MSSQL Server Failed Logon · sigma-rule
• MSSQL Server Failed Logon From External Network · sigma-rule
• Mstsc.EXE Execution With Local RDP File · sigma-rule
• Msxsl.EXE Execution · sigma-rule
• Narrator's Feedback-Hub Persistence · sigma-rule
• NET NGenAssemblyUsageLog Registry Key Tamper · sigma-rule
• Net WebClient Casing Anomalies · sigma-rule
• Netcat The Powershell Version · sigma-rule
• NetNTLM Downgrade Attack · sigma-rule
• NetNTLM Downgrade Attack - Registry · sigma-rule
• Netsh Allow Group Policy on Microsoft Defender Firewall · sigma-rule
• Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder · sigma-rule
• Network Communication Initiated To Portmap.IO Domain · sigma-rule
• Network Communication With Crypto Mining Pool · sigma-rule
• Network Connection Initiated By AddinUtil.EXE · sigma-rule
• Network Connection Initiated By Eqnedt32.EXE · sigma-rule
• Network Connection Initiated By IMEWDBLD.EXE · sigma-rule
• Network Connection Initiated By Regsvr32.EXE · sigma-rule
• Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location · sigma-rule
• Network Connection Initiated To AzureWebsites.NET By Non-Browser Process · sigma-rule
• Network Connection Initiated To BTunnels Domains · sigma-rule
• Network Connection Initiated To Cloudflared Tunnels Domains · sigma-rule
• Network Connection Initiated To DevTunnels Domain · sigma-rule
• Network Connection Initiated To Mega.nz · sigma-rule
• Network Connection Initiated To Visual Studio Code Tunnels Domain · sigma-rule
• Network Connection Initiated via Finger.EXE · sigma-rule
• Network Connection Initiated Via Notepad.EXE · sigma-rule
• Network Reconnaissance Activity · sigma-rule
• New Application in AppCompat · sigma-rule
• New BgInfo.EXE Custom DB Path Registry Configuration · sigma-rule
• New BgInfo.EXE Custom VBScript Registry Configuration · sigma-rule
• New BgInfo.EXE Custom WMI Query Registry Configuration · sigma-rule
• New BITS Job Created Via Bitsadmin · sigma-rule
• New BITS Job Created Via PowerShell · sigma-rule
• New Capture Session Launched Via DXCap.EXE · sigma-rule
• New Connection Initiated To Potential Dead Drop Resolver Domain · sigma-rule
• New Custom Shim Database Created · sigma-rule
• New DLL Added to AppCertDlls Registry Key · sigma-rule
• New DLL Added to AppInit_DLLs Registry Key · sigma-rule
• New DLL Registered Via Odbcconf.EXE · sigma-rule
• New DMSA Service Account Created in Specific OUs · sigma-rule
• New DNS ServerLevelPluginDll Installed · sigma-rule
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE · sigma-rule
• New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application · sigma-rule
• New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE · sigma-rule
• New Firewall Rule Added Via Netsh.EXE · sigma-rule
• New Generic Credentials Added Via Cmdkey.EXE · sigma-rule
• New Kernel Driver Via SC.EXE · sigma-rule
• New Module Module Added To IIS Server · sigma-rule
• New Netsh Helper DLL Registered From A Suspicious Location · sigma-rule
• New Network Trace Capture Started Via Netsh.EXE · sigma-rule
• New or Renamed User Account with '$' Character · sigma-rule
• New Outlook Macro Created · sigma-rule
• New PDQDeploy Service - Client Side · sigma-rule
• New PDQDeploy Service - Server Side · sigma-rule
• New Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
• New PortProxy Registry Entry Added · sigma-rule
• New PowerShell Instance Created · sigma-rule
• New Process Created Via Taskmgr.EXE · sigma-rule
• New Remote Desktop Connection Initiated Via Mstsc.EXE · sigma-rule
• New Root Certificate Installed Via CertMgr.EXE · sigma-rule
• New Root Certificate Installed Via Certutil.EXE · sigma-rule
• New Root or CA or AuthRoot Certificate to Store · sigma-rule
• New RUN Key Pointing to Suspicious Folder · sigma-rule
• New Service Creation Using PowerShell · sigma-rule
• New Service Creation Using Sc.EXE · sigma-rule
• New TimeProviders Registered With Uncommon DLL Name · sigma-rule
• New User Created Via Net.EXE · sigma-rule
• New User Created Via Net.EXE With Never Expire Option · sigma-rule
• NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE · sigma-rule
• Ngrok Usage with Remote Desktop Service · sigma-rule
• Nltest.EXE Execution · sigma-rule
• No Suitable Encryption Key Found For Generating Kerberos Ticket · sigma-rule
• Node Process Executions · sigma-rule
• NodeJS Execution of JavaScript File · sigma-rule
• Non Interactive PowerShell Process Spawned · sigma-rule
• Non-Mail Client IMAP Connection Hunt Starter · sigma-rule
• Non-privileged Usage of Reg or Powershell · sigma-rule
• Notepad Password Files Discovery · sigma-rule
• Notepad++ Updater DNS Query to Uncommon Domains · sigma-rule
• Nslookup PowerShell Download Cradle · sigma-rule
• NTDS Exfiltration Filename Patterns · sigma-rule
• NTDS.DIT Created · sigma-rule
• NTDS.DIT Creation By Uncommon Parent Process · sigma-rule
• NTDS.DIT Creation By Uncommon Process · sigma-rule
• Ntdsutil Abuse · sigma-rule
• NTFS Alternate Data Stream · sigma-rule
• NTFS Vulnerability Exploitation · sigma-rule
• NTLM Brute Force · sigma-rule
• NTLM Hash Leak Via Curl NTLM Authentication · sigma-rule
• NTLM Logon · sigma-rule
• NTLMv1 Logon Between Client and Server · sigma-rule
• Obfuscated PowerShell MSI Install via WindowsInstaller COM · sigma-rule
• Obfuscated PowerShell OneLiner Execution · sigma-rule
• Octopus Scanner Malware · sigma-rule
• Odbcconf.EXE Suspicious DLL Location · sigma-rule
• Office Application Initiated Network Connection To Non-Local IP · sigma-rule
• Office Application Startup - Office Test · sigma-rule
• Office Autorun Keys Modification · sigma-rule
• Office Macro File Creation · sigma-rule
• Office Macro File Creation From Suspicious Process · sigma-rule
• Office Macro File Download · sigma-rule
• Office Macros Warning Disabled · sigma-rule
• OneNote.EXE Execution of Malicious Embedded Scripts · sigma-rule
• OpenEDR Spawning Command Shell · sigma-rule
• OpenSSH Server Listening On Socket · sigma-rule
• OpenWith.exe Executes Specified Binary · sigma-rule
• Operator Bloopers Cobalt Strike Commands · sigma-rule
• Operator Bloopers Cobalt Strike Modules · sigma-rule
• Outbound Network Connection Initiated By Cmstp.EXE · sigma-rule
• Outbound Network Connection Initiated By Microsoft Dialer · sigma-rule
• Outbound Network Connection Initiated By Script Interpreter · sigma-rule
• Outbound Network Connection To Public IP Via Winlogon · sigma-rule
• Outbound RDP Connections Over Non-Standard Tools · sigma-rule
• Outgoing Logon with New Credentials · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled - Registry · sigma-rule
• Outlook Macro Execution Without Warning Setting Enabled · sigma-rule
• Outlook Security Settings Updated - Registry · sigma-rule
• PAExec Service Installation · sigma-rule
• Pass the Hash Activity 2 · sigma-rule
• Password Change on Directory Service Restore Mode (DSRM) Account · sigma-rule
• Password Dumper Activity on LSASS · sigma-rule
• Password Dumper Remote Thread in LSASS · sigma-rule
• Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy · sigma-rule
• Password Policy Enumerated · sigma-rule
• Password Protected ZIP File Opened · sigma-rule
• Password Protected ZIP File Opened (Email Attachment) · sigma-rule
• Password Protected ZIP File Opened (Suspicious Filenames) · sigma-rule
• Password Provided In Command Line Of Net.EXE · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Path To Screensaver Binary Modified · sigma-rule
• PCRE.NET Package Image Load · sigma-rule
• PCRE.NET Package Temp Files · sigma-rule
• PDQ Deploy Remote Adminstartion Tool Execution · sigma-rule
• Periodic Backup For System Registry Hives Enabled · sigma-rule
• Perl Inline Command Execution · sigma-rule
• Permission Check Via Accesschk.EXE · sigma-rule
• Permission Misconfiguration Reconnaissance Via Findstr.EXE · sigma-rule
• Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
• Persistence Via New SIP Provider · sigma-rule
• Persistence Via Sticky Key Backdoor · sigma-rule
• PetitPotam Suspicious Kerberos TGT Request · sigma-rule
• Phishing Pattern ISO in Archive · sigma-rule
• Php Inline Command Execution · sigma-rule
• Ping Hex IP · sigma-rule
• PktMon.EXE Execution · sigma-rule
• Port Forwarding Activity Via SSH.EXE · sigma-rule
• Portable Gpg.EXE Execution · sigma-rule
• Possible DC Shadow Attack · sigma-rule
• Possible Impacket SecretDump Remote Activity · sigma-rule
• Possible PetitPotam Coerce Authentication Attempt · sigma-rule
• Possible Privilege Escalation via Weak Service Permissions · sigma-rule
• Possible Shadow Credentials Added · sigma-rule
• Potential 7za.DLL Sideloading · sigma-rule
• Potential Access Token Abuse · sigma-rule
• Potential Active Directory Reconnaissance/Enumeration Via LDAP · sigma-rule
• Potential AD User Enumeration From Non-Machine Account · sigma-rule
• Potential Adplus.EXE Abuse · sigma-rule
• Potential Amazon SSM Agent Hijacking · sigma-rule
• Potential AMSI Bypass Script Using NULL Bits · sigma-rule
• Potential AMSI Bypass Using NULL Bits · sigma-rule
• Potential AMSI Bypass Via .NET Reflection · sigma-rule
• Potential AMSI COM Server Hijacking · sigma-rule
• Potential Antivirus Software DLL Sideloading · sigma-rule
• Potential Application Whitelisting Bypass via Dnx.EXE · sigma-rule
• Potential appverifUI.DLL Sideloading · sigma-rule
• Potential Arbitrary Code Execution Via Node.EXE · sigma-rule
• Potential Arbitrary Command Execution Using Msdt.EXE · sigma-rule
• Potential Arbitrary Command Execution Via FTP.EXE · sigma-rule
• Potential Arbitrary DLL Load Using Winword · sigma-rule
• Potential Arbitrary File Download Using Office Application · sigma-rule
• Potential Arbitrary File Download Via Cmdl32.EXE · sigma-rule
• Potential AutoLogger Sessions Tampering · sigma-rule
• Potential AVKkid.DLL Sideloading · sigma-rule
• Potential Azure Browser SSO Abuse · sigma-rule
• Potential Binary Impersonating Sysinternals Tools · sigma-rule
• Potential Binary Proxy Execution Via Cdb.EXE · sigma-rule
• Potential Binary Proxy Execution Via VSDiagnostics.EXE · sigma-rule
• Potential Browser Data Stealing · sigma-rule
• Potential CCleanerDU.DLL Sideloading · sigma-rule
• Potential CCleanerReactivator.DLL Sideloading · sigma-rule
• Potential Chrome Frame Helper DLL Sideloading · sigma-rule
• Potential ClickFix Execution Pattern - Registry · sigma-rule
• Potential CobaltStrike Process Patterns · sigma-rule
• Potential CobaltStrike Service Installations - Registry · sigma-rule
• Potential COM Object Hijacking Via TreatAs Subkey - Registry · sigma-rule
• Potential COM Objects Download Cradles Usage - Process Creation · sigma-rule
• Potential COM Objects Download Cradles Usage - PS Script · sigma-rule
• Potential Command Line Path Traversal Evasion Attempt · sigma-rule
• Potential Commandline Obfuscation Using Escape Characters · sigma-rule
• Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image · sigma-rule
• Potential CommandLine Path Traversal Via Cmd.EXE · sigma-rule
• Potential Configuration And Service Reconnaissance Via Reg.EXE · sigma-rule
• Potential Credential Dumping Activity Via LSASS · sigma-rule
• Potential Credential Dumping Attempt Using New NetworkProvider - CLI · sigma-rule
• Potential Credential Dumping Attempt Using New NetworkProvider - REG · sigma-rule
• Potential Credential Dumping Attempt Via PowerShell Remote Thread · sigma-rule
• Potential Credential Dumping Via LSASS Process Clone · sigma-rule
• Potential Credential Dumping Via LSASS SilentProcessExit Technique · sigma-rule
• Potential Credential Dumping Via WER · sigma-rule
• Potential Crypto Mining Activity · sigma-rule
• Potential Data Exfiltration Activity Via CommandLine Tools · sigma-rule
• Potential Data Stealing Via Chromium Headless Debugging · sigma-rule
• Potential DCOM InternetExplorer.Application DLL Hijack · sigma-rule
• Potential DCOM InternetExplorer.Application DLL Hijack - Image Load · sigma-rule
• Potential Defense Evasion Via Binary Rename · sigma-rule
• Potential Defense Evasion Via Raw Disk Access By Uncommon Tools · sigma-rule
• Potential Defense Evasion Via Rename Of Highly Relevant Binaries · sigma-rule
• Potential Defense Evasion Via Right-to-Left Override · sigma-rule
• Potential Direct Syscall of NtOpenProcess · sigma-rule
• Potential DLL File Download Via PowerShell Invoke-WebRequest · sigma-rule
• Potential DLL Injection Or Execution Using Tracker.exe · sigma-rule
• Potential DLL Sideloading Of DBGCORE.DLL · sigma-rule
• Potential DLL Sideloading Of DBGHELP.DLL · sigma-rule
• Potential DLL Sideloading Of DbgModel.DLL · sigma-rule
• Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE · sigma-rule
• Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE · sigma-rule
• Potential DLL Sideloading Of MpSvc.DLL · sigma-rule
• Potential DLL Sideloading Of MsCorSvc.DLL · sigma-rule
• Potential DLL Sideloading Of Non-Existent DLLs From System Folders · sigma-rule
• Potential DLL Sideloading Using Coregen.exe · sigma-rule
• Potential DLL Sideloading Via ClassicExplorer32.dll · sigma-rule
• Potential DLL Sideloading Via comctl32.dll · sigma-rule
• Potential DLL Sideloading Via DeviceEnroller.EXE · sigma-rule
• Potential DLL Sideloading Via JsSchHlp · sigma-rule
• Potential DLL Sideloading Via VMware Xfer · sigma-rule
• Potential Dosfuscation Activity · sigma-rule
• Potential Download/Upload Activity Using Type Command · sigma-rule
• Potential Dropper Script Execution Via WScript/CScript/MSHTA · sigma-rule
• Potential EACore.DLL Sideloading · sigma-rule
• Potential Edputil.DLL Sideloading · sigma-rule
• Potential Encoded PowerShell Patterns In CommandLine · sigma-rule
• Potential EventLog File Location Tampering · sigma-rule
• Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp · sigma-rule
• Potential Execution of Sysinternals Tools · sigma-rule
• Potential Fake Instance Of Hxtsr.EXE Executed · sigma-rule
• Potential File Download Via MS-AppInstaller Protocol Handler · sigma-rule
• Potential File Extension Spoofing Using Right-to-Left Override · sigma-rule
• Potential File Overwrite Via Sysinternals SDelete · sigma-rule
• Potential Goopdate.DLL Sideloading · sigma-rule
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream · sigma-rule
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI · sigma-rule
• Potential Homoglyph Attack Using Lookalike Characters · sigma-rule
• Potential Homoglyph Attack Using Lookalike Characters in Filename · sigma-rule
• Potential In-Memory Execution Using Reflection.Assembly · sigma-rule
• Potential Initial Access via DLL Search Order Hijacking · sigma-rule
• Potential Invoke-Mimikatz PowerShell Script · sigma-rule
• Potential Iviewers.DLL Sideloading · sigma-rule
• Potential JLI.dll Side-Loading · sigma-rule
• Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation · sigma-rule
• Potential Keylogger Activity · sigma-rule
• Potential Lateral Movement via Windows Remote Shell · sigma-rule
• Potential LethalHTA Technique Execution · sigma-rule
• Potential Libvlc.DLL Sideloading · sigma-rule
• Potential LSASS Process Dump Via Procdump · sigma-rule
• Potential Manage-bde.wsf Abuse To Proxy Execution · sigma-rule
• Potential Meterpreter/CobaltStrike Activity · sigma-rule
• Potential Mfdetours.DLL Sideloading · sigma-rule
• Potential Mftrace.EXE Abuse · sigma-rule
• Potential Mpclient.DLL Sideloading · sigma-rule
• Potential Mpclient.DLL Sideloading Via Defender Binaries · sigma-rule
• Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution · sigma-rule
• Potential MsiExec Masquerading · sigma-rule
• Potential MSTSC Shadowing Activity · sigma-rule
• Potential Network Sniffing Activity Using Network Tools · sigma-rule
• Potential NTLM Coercion Via Certutil.EXE · sigma-rule
• Potential Obfuscated Ordinal Call Via Rundll32 · sigma-rule
• Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock · sigma-rule
• Potential Password Spraying Attempt Using Dsacls.EXE · sigma-rule
• Potential PendingFileRenameOperations Tampering · sigma-rule
• Potential Persistence Attempt Via Existing Service Tampering · sigma-rule
• Potential Persistence Attempt Via Run Keys Using Reg.EXE · sigma-rule
• Potential Persistence Using DebugPath · sigma-rule
• Potential Persistence Via App Paths Default Property · sigma-rule
• Potential Persistence Via AppCompat RegisterAppRestart Layer · sigma-rule
• Potential Persistence Via Custom Protocol Handler · sigma-rule
• Potential Persistence Via Event Viewer Events.asp · sigma-rule
• Potential Persistence Via Excel Add-in - Registry · sigma-rule
• Potential Persistence Via GlobalFlags · sigma-rule
• Potential Persistence Via Logon Scripts - CommandLine · sigma-rule
• Potential Persistence Via Logon Scripts - Registry · sigma-rule
• Potential Persistence Via Microsoft Compatibility Appraiser · sigma-rule
• Potential Persistence Via Microsoft Office Add-In · sigma-rule
• Potential Persistence Via Microsoft Office Startup Folder · sigma-rule
• Potential Persistence Via Netsh Helper DLL · sigma-rule
• Potential Persistence Via Netsh Helper DLL - Registry · sigma-rule
• Potential Persistence Via Outlook Form · sigma-rule
• Potential Persistence Via Outlook Home Page · sigma-rule
• Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting · sigma-rule
• Potential Persistence Via Outlook Today Page · sigma-rule
• Potential Persistence Via Powershell Search Order Hijacking - Task · sigma-rule
• Potential Persistence Via PowerShell User Profile Using Add-Content · sigma-rule
• Potential Persistence Via Scrobj.dll COM Hijacking · sigma-rule
• Potential Persistence Via Shim Database In Uncommon Location · sigma-rule
• Potential Persistence Via Shim Database Modification · sigma-rule
• Potential Persistence Via Visual Studio Tools for Office · sigma-rule
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Potential PowerShell Command Line Obfuscation · sigma-rule
• Potential PowerShell Console History Access Attempt via History File · sigma-rule
• Potential PowerShell Downgrade Attack · sigma-rule
• Potential PowerShell Execution Via DLL · sigma-rule
• Potential PowerShell Obfuscation Using Alias Cmdlets · sigma-rule
• Potential PowerShell Obfuscation Using Character Join · sigma-rule
• Potential PowerShell Obfuscation Via Reversed Commands · sigma-rule
• Potential PowerShell Obfuscation Via WCHAR/CHAR · sigma-rule
• Potential Powershell ReverseShell Connection · sigma-rule
• Potential Privilege Escalation To LOCAL SYSTEM · sigma-rule
• Potential Privilege Escalation Using Symlink Between Osk and Cmd · sigma-rule
• Potential Privilege Escalation via Local Kerberos Relay over LDAP · sigma-rule
• Potential Privilege Escalation via Service Permissions Weakness · sigma-rule
• Potential Privileged System Service Operation - SeLoadDriverPrivilege · sigma-rule
• Potential Process Execution Proxy Via CL_Invocation.ps1 · sigma-rule
• Potential Process Hollowing Activity · sigma-rule
• Potential Process Injection Via Msra.EXE · sigma-rule
• Potential Process Reconnaissance via Wmic.EXE · sigma-rule
• Potential Product Class Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Product Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution · sigma-rule
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG · sigma-rule
• Potential Provlaunch.EXE Binary Proxy Execution Abuse · sigma-rule
• Potential PsExec Remote Execution · sigma-rule
• Potential PSFactoryBuffer COM Hijacking · sigma-rule
• Potential Python DLL SideLoading · sigma-rule
• Potential Qakbot Registry Activity · sigma-rule
• Potential Ransomware Activity Using LegalNotice Message · sigma-rule
• Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE · sigma-rule
• Potential Rcdll.DLL Sideloading · sigma-rule
• Potential RDP Tunneling Via Plink · sigma-rule
• Potential RDP Tunneling Via SSH · sigma-rule
• Potential Recon Activity Via Nltest.EXE · sigma-rule
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
• Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE · sigma-rule
• Potential ReflectDebugger Content Execution Via WerFault.EXE · sigma-rule
• Potential Register_App.Vbs LOLScript Abuse · sigma-rule
• Potential Registry Persistence Attempt Via DbgManagedDebugger · sigma-rule
• Potential Registry Persistence Attempt Via Windows Telemetry · sigma-rule
• Potential Regsvr32 Commandline Flag Anomaly · sigma-rule
• Potential Remote Desktop Connection to Non-Domain Host · sigma-rule
• Potential Remote Desktop Tunneling · sigma-rule
• Potential Remote PowerShell Session Initiated · sigma-rule
• Potential Remote SquiblyTwo Technique Execution · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module · sigma-rule
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock · sigma-rule
• Potential RipZip Attack on Startup Folder · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Default Location · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Non-Default Location · sigma-rule
• Potential RoboForm.DLL Sideloading · sigma-rule
• Potential Rundll32 Execution With DLL Stored In ADS · sigma-rule
• Potential SAM Database Dump · sigma-rule
• Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 · sigma-rule
• Potential Secure Deletion with SDelete · sigma-rule
• Potential ShellDispatch.DLL Sideloading · sigma-rule
• Potential Shim Database Persistence via Sdbinst.EXE · sigma-rule
• Potential SmadHook.DLL Sideloading · sigma-rule
• Potential SMB Relay Attack Tool Execution · sigma-rule
• Potential SolidPDFCreator.DLL Sideloading · sigma-rule
• Potential SPN Enumeration Via Setspn.EXE · sigma-rule
• Potential SSH Tunnel Persistence Install Using A Scheduled Task · sigma-rule
• Potential Startup Shortcut Persistence Via PowerShell.EXE · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Potential Suspicious Browser Launch From Document Reader Process · sigma-rule
• Potential Suspicious Mofcomp Execution · sigma-rule
• Potential Suspicious PowerShell Keywords · sigma-rule
• Potential Suspicious Registry File Imported Via Reg.EXE · sigma-rule
• Potential SysInternals ProcDump Evasion · sigma-rule
• Potential System DLL Sideloading From Non System Locations · sigma-rule
• Potential Tampering With RDP Related Registry Keys Via Reg.EXE · sigma-rule
• Potential Tampering With Security Products Via WMIC · sigma-rule
• Potential UAC Bypass Via Sdclt.EXE · sigma-rule
• Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock · sigma-rule
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Vcruntime140 DLL Sideloading · sigma-rule
• Potential Vivaldi_elf.DLL Sideloading · sigma-rule
• Potential Waveedit.DLL Sideloading · sigma-rule
• Potential Wazuh Security Platform DLL Sideloading · sigma-rule
• Potential Webshell Creation On Static Website · sigma-rule
• Potential WerFault ReflectDebugger Registry Value Abuse · sigma-rule
• Potential WinAPI Calls Via CommandLine · sigma-rule
• Potential WinAPI Calls Via PowerShell Scripts · sigma-rule
• Potential Windows Defender AV Bypass Via Dump64.EXE Rename · sigma-rule
• Potential Windows Defender Tampering Via Wmic.EXE · sigma-rule
• Potential Winnti Dropper Activity · sigma-rule
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell · sigma-rule
• Potential WWlib.DLL Sideloading · sigma-rule
• Potentially Over Permissive Permissions Granted Using Dsacls.EXE · sigma-rule
• Potentially Suspicious AccessMask Requested From LSASS · sigma-rule
• Potentially Suspicious ASP.NET Compilation Via AspNetCompiler · sigma-rule
• Potentially Suspicious Cabinet File Expansion · sigma-rule
• Potentially Suspicious Child Process Of DiskShadow.EXE · sigma-rule
• Potentially Suspicious Child Process of KeyScrambler.exe · sigma-rule
• Potentially Suspicious Child Process Of Regsvr32 · sigma-rule
• Potentially Suspicious Child Process Of VsCode · sigma-rule
• Potentially Suspicious Child Process Of WinRAR.EXE · sigma-rule
• Potentially Suspicious Child Processes Spawned by ConHost · sigma-rule
• Potentially Suspicious CMD Shell Output Redirect · sigma-rule
• Potentially Suspicious Command Executed Via Run Dialog Box - Registry · sigma-rule
• Potentially Suspicious Command Targeting Teams Sensitive Files · sigma-rule
• Potentially Suspicious Desktop Background Change Using Reg.EXE · sigma-rule
• Potentially Suspicious Desktop Background Change Via Registry · sigma-rule
• Potentially Suspicious DLL Registered Via Odbcconf.EXE · sigma-rule
• Potentially Suspicious Event Viewer Child Process · sigma-rule
• Potentially Suspicious EventLog Recon Activity Using Log Query Utilities · sigma-rule
• Potentially Suspicious Execution From Parent Process In Public Folder · sigma-rule
• Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location · sigma-rule
• Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension · sigma-rule
• Potentially Suspicious File Creation by OpenEDR's ITSMService · sigma-rule
• Potentially Suspicious GrantedAccess Flags On LSASS · sigma-rule
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary · sigma-rule
• Potentially Suspicious JWT Token Search Via CLI · sigma-rule
• Potentially Suspicious Malware Callback Communication · sigma-rule
• Potentially Suspicious Network Connection To Notion API · sigma-rule
• Potentially Suspicious NTFS Symlink Behavior Modification · sigma-rule
• Potentially Suspicious ODBC Driver Registered · sigma-rule
• Potentially Suspicious Office Document Executed From Trusted Location · sigma-rule
• Potentially Suspicious Ping/Copy Command Combination · sigma-rule
• Potentially Suspicious Powershell Script Execution From Temp Folder · sigma-rule
• Potentially Suspicious Regsvr32 HTTP IP Pattern · sigma-rule
• Potentially Suspicious Regsvr32 HTTP/FTP Pattern · sigma-rule
• Potentially Suspicious Rundll32 Activity · sigma-rule
• Potentially Suspicious Rundll32.EXE Execution of UDL File · sigma-rule
• Potentially Suspicious Self Extraction Directive File Created · sigma-rule
• Potentially Suspicious Usage Of Qemu · sigma-rule
• Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load · sigma-rule
• Potentially Suspicious WebDAV LNK Execution · sigma-rule
• Potentially Suspicious Wuauclt Network Connection · sigma-rule
• Powershell Add Name Resolution Policy Table Rule · sigma-rule
• PowerShell ADRecon Execution · sigma-rule
• PowerShell as a Service in Registry · sigma-rule
• PowerShell Base64 Encoded FromBase64String Cmdlet · sigma-rule
• PowerShell Base64 Encoded IEX Cmdlet · sigma-rule
• PowerShell Base64 Encoded Invoke Keyword · sigma-rule
• Powershell Base64 Encoded MpPreference Cmdlet · sigma-rule
• PowerShell Base64 Encoded Reflective Assembly Load · sigma-rule
• PowerShell Base64 Encoded WMI Classes · sigma-rule
• PowerShell Called from an Executable Version Mismatch · sigma-rule
• PowerShell Console History Logs Deleted · sigma-rule
• PowerShell Core DLL Loaded By Non PowerShell Process · sigma-rule
• PowerShell Create Local User · sigma-rule
• Powershell Create Scheduled Task · sigma-rule
• PowerShell Credential Prompt · sigma-rule
• PowerShell Decompress Commands · sigma-rule
• Powershell Defender Disable Scan Feature · sigma-rule
• Powershell Defender Exclusion · sigma-rule
• PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' · sigma-rule
• PowerShell Deleted Mounted Share · sigma-rule
• Powershell Detect Virtualization Environment · sigma-rule
• Powershell Directory Enumeration · sigma-rule
• Powershell DNSExfiltration · sigma-rule
• PowerShell Downgrade Attack - PowerShell · sigma-rule
• PowerShell Download and Execution Cradles · sigma-rule
• PowerShell Download Pattern · sigma-rule
• PowerShell Download Via Net.WebClient - PowerShell Classic · sigma-rule
• Powershell Execute Batch Script · sigma-rule
• Powershell Executed From Headless ConHost Process · sigma-rule
• PowerShell Get Clipboard · sigma-rule
• PowerShell Get-Clipboard Cmdlet Via CLI · sigma-rule
• PowerShell Get-Process LSASS · sigma-rule
• PowerShell Get-Process LSASS in ScriptBlock · sigma-rule
• PowerShell ICMP Exfiltration · sigma-rule
• Powershell Inline Execution From A File · sigma-rule
• Powershell Install a DLL in System Directory · sigma-rule
• Powershell Keylogging · sigma-rule
• Powershell Local Email Collection · sigma-rule
• Powershell LocalAccount Manipulation · sigma-rule
• PowerShell Logging Disabled Via Registry Key Tampering · sigma-rule
• PowerShell MSI Install via WindowsInstaller COM From Remote Location · sigma-rule
• Powershell MsXml COM Object · sigma-rule
• PowerShell Profile Modification · sigma-rule
• PowerShell PSAttack · sigma-rule
• PowerShell Remote Session Creation · sigma-rule
• PowerShell SAM Copy · sigma-rule
• PowerShell Script Change Permission Via Set-Acl - PsScript · sigma-rule
• PowerShell Script Run in AppData · sigma-rule
• PowerShell Script With File Hostname Resolving Capabilities · sigma-rule
• PowerShell Script With File Upload Capabilities · sigma-rule
• PowerShell Scripts Installed as Services · sigma-rule
• PowerShell Scripts Installed as Services - Security · sigma-rule
• Powershell Sensitive File Discovery · sigma-rule
• PowerShell Set-Acl On Windows Folder - PsScript · sigma-rule
• PowerShell ShellCode · sigma-rule
• Powershell Store File In Alternate Data Stream · sigma-rule
• Powershell Suspicious Win32_PnPEntity · sigma-rule
• Powershell Timestomp · sigma-rule
• Powershell Token Obfuscation - Process Creation · sigma-rule
• PowerShell Web Access Feature Enabled Via DISM · sigma-rule
• PowerShell Web Access Installation - PsScript · sigma-rule
• Powershell WMI Persistence · sigma-rule
• PowerShell WMI Win32_Product Install MSI · sigma-rule
• Powershell XML Execute Command · sigma-rule
• Powerview Add-DomainObjectAcl DCSync AD Extend Right · sigma-rule
• PowerView PowerShell Cmdlets - ScriptBlock · sigma-rule
• PPL Tampering Via WerFaultSecure · sigma-rule
• Prefetch File Deleted · sigma-rule
• Previously Installed IIS Module Was Removed · sigma-rule
• PrintBrm ZIP Creation of Extraction · sigma-rule
• Private Keys Reconnaissance Via CommandLine Tools · sigma-rule
• Privilege Escalation via Named Pipe Impersonation · sigma-rule
• Procdump Execution · sigma-rule
• Process Access via TrolleyExpress Exclusion · sigma-rule
• Process Creation Attempt via Wmic.EXE · sigma-rule
• Process Creation Using Sysnative Folder · sigma-rule
• Process Execution From A Potentially Suspicious Folder · sigma-rule
• Process Explorer Driver Creation By Non-Sysinternals Binary · sigma-rule
• Process Initiated Network Connection To Ngrok Domain · sigma-rule
• Process Memory Dump Via Comsvcs.DLL · sigma-rule
• Process Memory Dump Via Dotnet-Dump · sigma-rule
• Process Memory Dump via RdrLeakDiag.EXE · sigma-rule
• Process Monitor Driver Creation By Non-Sysinternals Binary · sigma-rule
• Process Proxy Execution Via Squirrel.EXE · sigma-rule
• Processes Accessing the Microphone and Webcam · sigma-rule
• ProcessHacker Privilege Elevation · sigma-rule
• Program Executed Using Proxy/Local Command Via SSH.EXE · sigma-rule
• Protected Storage Service Access · sigma-rule
• Proxy Execution via Vshadow · sigma-rule
• Proxy Execution Via Wuauclt.EXE · sigma-rule
• ProxyLogon MSExchange OabVirtualDirectory · sigma-rule
• PSAsyncShell - Asynchronous TCP Reverse Shell · sigma-rule
• PSExec and WMI Process Creations Block · sigma-rule
• Psexec Execution · sigma-rule
• PSEXEC Remote Execution File Artefact · sigma-rule
• PsExec Service File Creation · sigma-rule
• PsExec Service Installation · sigma-rule
• PsExec Tool Execution From Suspicious Locations - PipeName · sigma-rule
• PsExec/PAExec Escalation to LOCAL SYSTEM · sigma-rule
• PUA - 3Proxy Execution · sigma-rule
• PUA - AdFind Suspicious Execution · sigma-rule
• PUA - AdFind.EXE Execution · sigma-rule
• PUA - Adidnsdump Execution · sigma-rule
• PUA - Advanced IP Scanner Execution · sigma-rule
• PUA - Advanced Port Scanner Execution · sigma-rule
• PUA - AdvancedRun Execution · sigma-rule
• PUA - AdvancedRun Suspicious Execution · sigma-rule
• PUA - Chisel Tunneling Tool Execution · sigma-rule
• PUA - CleanWipe Execution · sigma-rule
• PUA - Crassus Execution · sigma-rule
• PUA - CSExec Default Named Pipe · sigma-rule
• PUA - CsExec Execution · sigma-rule
• PUA - DefenderCheck Execution · sigma-rule
• PUA - DIT Snapshot Viewer · sigma-rule
• PUA - Fast Reverse Proxy (FRP) Execution · sigma-rule
• PUA - Kernel Driver Utility (KDU) Execution · sigma-rule
• PUA - Memory Dump Mount Via MemProcFS · sigma-rule
• PUA - Mouse Lock Execution · sigma-rule
• PUA - Netcat Suspicious Execution · sigma-rule
• PUA - Ngrok Execution · sigma-rule
• PUA - Nimgrab Execution · sigma-rule
• PUA - NimScan Execution · sigma-rule
• PUA - NirCmd Execution · sigma-rule
• PUA - NirCmd Execution As LOCAL SYSTEM · sigma-rule
• PUA - Nmap/Zenmap Execution · sigma-rule
• PUA - NPS Tunneling Tool Execution · sigma-rule
• PUA - NSudo Execution · sigma-rule
• PUA - PAExec Default Named Pipe · sigma-rule
• PUA - PingCastle Execution · sigma-rule
• PUA - PingCastle Execution From Potentially Suspicious Parent · sigma-rule
• PUA - Potential PE Metadata Tamper Using Rcedit · sigma-rule
• PUA - Process Hacker Driver Load · sigma-rule
• PUA - Process Hacker Execution · sigma-rule
• PUA - Radmin Viewer Utility Execution · sigma-rule
• PUA - Rclone Execution · sigma-rule
• PUA - RemCom Default Named Pipe · sigma-rule
• PUA - Restic Backup Tool Execution · sigma-rule
• PUA - RunXCmd Execution · sigma-rule
• PUA - Seatbelt Execution · sigma-rule
• PUA - SoftPerfect Netscan Execution · sigma-rule
• PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE · sigma-rule
• PUA - Sysinternal Tool Execution - Registry · sigma-rule
• PUA - Sysinternals Tools Execution - Registry · sigma-rule
• PUA - System Informer Driver Load · sigma-rule
• PUA - System Informer Execution · sigma-rule
• PUA - TruffleHog Execution · sigma-rule
• PUA - WebBrowserPassView Execution · sigma-rule
• PUA - Wsudo Suspicious Execution · sigma-rule
• PUA- IOX Tunneling Tool Execution · sigma-rule
• Pubprn.vbs Proxy Execution · sigma-rule
• Python Function Execution Security Warning Disabled In Excel · sigma-rule
• Python Function Execution Security Warning Disabled In Excel - Registry · sigma-rule
• Python Image Load By Non-Python Process · sigma-rule
• Python Initiated Connection · sigma-rule
• Python Inline Command Execution · sigma-rule
• Python One-Liners with Base64 Decoding · sigma-rule
• Python Spawning Pretty TTY on Windows · sigma-rule
• Query Tor Onion Address - DNS Client · sigma-rule
• QuickAssist Execution · sigma-rule
• Raccine Uninstall · sigma-rule
• Rar Usage with Password and Compression Level · sigma-rule
• Rare Remote Thread Creation By Uncommon Source Image · sigma-rule
• Rclone Config File Creation · sigma-rule
• RDP Connection Allowed Via Netsh.EXE · sigma-rule
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · sigma-rule
• RDP Login from Localhost · sigma-rule
• RDP Over Reverse SSH Tunnel · sigma-rule
• RDP over Reverse SSH Tunnel WFP · sigma-rule
• RDP Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
• RDP Sensitive Settings Changed · sigma-rule
• RDP Sensitive Settings Changed to Zero · sigma-rule
• RDP to HTTP or HTTPS Target Ports · sigma-rule
• Read Contents From Stdin Via Cmd.EXE · sigma-rule
• Recon Command Output Piped To Findstr.EXE · sigma-rule
• Recon Information for Export with Command Prompt · sigma-rule
• Recon Information for Export with PowerShell · sigma-rule
• Reconnaissance Activity · sigma-rule
• RedMimicry Winnti Playbook Registry Manipulation · sigma-rule
• Reg Add Suspicious Paths · sigma-rule
• RegAsm.EXE Execution Without CommandLine Flags or Files · sigma-rule
• RegAsm.EXE Initiating Network Connection To Public IP · sigma-rule
• Regedit as Trusted Installer · sigma-rule
• Register new Logon Process by Rubeus · sigma-rule
• REGISTER_APP.VBS Proxy Execution · sigma-rule
• Registry Disable System Restore · sigma-rule
• Registry Entries For Azorult Malware · sigma-rule
• Registry Enumeration via WMI Stdregprov · sigma-rule
• Registry Explorer Policy Modification · sigma-rule
• Registry Export of Third-Party Credentials · sigma-rule
• Registry Hide Function from User · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Registry Modification Attempt Via VBScript · sigma-rule
• Registry Modification Attempt Via VBScript - PowerShell · sigma-rule
• Registry Modification for OCI DLL Redirection · sigma-rule
• Registry Modification of MS-settings Protocol Handler · sigma-rule
• Registry Modification to Hidden File Extension · sigma-rule
• Registry Modification Via Regini.EXE · sigma-rule
• Registry Persistence Mechanisms in Recycle Bin · sigma-rule
• Registry Persistence via Explorer Run Key · sigma-rule
• Registry Persistence via Service in Safe Mode · sigma-rule
• Registry Tampering by Potentially Suspicious Processes · sigma-rule
• Registry-Free Process Scope COR_PROFILER · sigma-rule
• Regsvr32 DLL Execution With Suspicious File Extension · sigma-rule
• Regsvr32 DLL Execution With Uncommon Extension · sigma-rule
• Regsvr32 Execution From Highly Suspicious Location · sigma-rule
• Regsvr32 Execution From Potential Suspicious Location · sigma-rule
• Relevant Anti-Virus Signature Keywords In Application Log · sigma-rule
• RemCom Service File Creation · sigma-rule
• RemCom Service Installation · sigma-rule
• Remote Access Tool - AnyDesk Execution · sigma-rule
• Remote Access Tool - Anydesk Execution From Suspicious Folder · sigma-rule
• Remote Access Tool - AnyDesk Incoming Connection · sigma-rule
• Remote Access Tool - AnyDesk Piped Password Via CLI · sigma-rule
• Remote Access Tool - AnyDesk Silent Installation · sigma-rule
• Remote Access Tool - GoToAssist Execution · sigma-rule
• Remote Access Tool - LogMeIn Execution · sigma-rule
• Remote Access Tool - MeshAgent Command Execution via MeshCentral · sigma-rule
• Remote Access Tool - NetSupport Execution · sigma-rule
• Remote Access Tool - Potential MeshAgent Execution - Windows · sigma-rule
• Remote Access Tool - Renamed MeshAgent Execution - Windows · sigma-rule
• Remote Access Tool - ScreenConnect Command Execution · sigma-rule
• Remote Access Tool - ScreenConnect Execution · sigma-rule
• Remote Access Tool - ScreenConnect File Transfer · sigma-rule
• Remote Access Tool - ScreenConnect Installation Execution · sigma-rule
• Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution · sigma-rule
• Remote Access Tool - ScreenConnect Remote Command Execution · sigma-rule
• Remote Access Tool - ScreenConnect Server Web Shell Execution · sigma-rule
• Remote Access Tool - ScreenConnect Temporary File · sigma-rule
• Remote Access Tool - Simple Help Execution · sigma-rule
• Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server · sigma-rule
• Remote Access Tool - Team Viewer Session Started On Windows Host · sigma-rule
• Remote Access Tool - UltraViewer Execution · sigma-rule
• Remote Access Tool Services Have Been Installed - Security · sigma-rule
• Remote Access Tool Services Have Been Installed - System · sigma-rule
• Remote CHM File Download/Execution Via HH.EXE · sigma-rule
• Remote Code Execute via Winrm.vbs · sigma-rule
• Remote DLL Load Via Rundll32.EXE · sigma-rule
• Remote File Download Via Desktopimgdownldr Utility · sigma-rule
• Remote File Download Via Findstr.EXE · sigma-rule
• Remote LSASS Process Access Through Windows Remote Management · sigma-rule
• Remote PowerShell Session (PS Classic) · sigma-rule
• Remote PowerShell Session (PS Module) · sigma-rule
• Remote PowerShell Session Host Process (WinRM) · sigma-rule
• Remote PowerShell Sessions Network Connections (WinRM) · sigma-rule
• Remote Service Activity via SVCCTL Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Remote Thread Created In KeePass.EXE · sigma-rule
• Remote Thread Creation By Uncommon Source Image · sigma-rule
• Remote Thread Creation In Uncommon Target Image · sigma-rule
• Remote Thread Creation Ttdinject.exe Proxy · sigma-rule
• Remote Thread Creation Via PowerShell In Uncommon Target · sigma-rule
• Remote XSL Execution Via Msxsl.EXE · sigma-rule
• RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses · sigma-rule
• Remotely Hosted HTA File Executed Via Mshta.EXE · sigma-rule
• Removal Of AMSI Provider Registry Keys · sigma-rule
• Removal Of Index Value to Hide Schedule Task - Registry · sigma-rule
• Removal of Potential COM Hijacking Registry Keys · sigma-rule
• Removal Of SD Value to Hide Schedule Task - Registry · sigma-rule
• Remove Account From Domain Admin Group · sigma-rule
• Remove Exported Mailbox from Exchange Webserver · sigma-rule
• Renamed AdFind Execution · sigma-rule
• Renamed AutoIt Execution · sigma-rule
• Renamed BOINC Client Execution · sigma-rule
• Renamed BrowserCore.EXE Execution · sigma-rule
• Renamed Cloudflared.EXE Execution · sigma-rule
• Renamed CreateDump Utility Execution · sigma-rule
• Renamed CURL.EXE Execution · sigma-rule
• Renamed FTP.EXE Execution · sigma-rule
• Renamed Gpg.EXE Execution · sigma-rule
• Renamed Jusched.EXE Execution · sigma-rule
• Renamed Mavinject.EXE Execution · sigma-rule
• Renamed MegaSync Execution · sigma-rule
• Renamed Msdt.EXE Execution · sigma-rule
• Renamed NirCmd.EXE Execution · sigma-rule
• Renamed Office Binary Execution · sigma-rule
• Renamed PAExec Execution · sigma-rule
• Renamed PingCastle Binary Execution · sigma-rule
• Renamed Plink Execution · sigma-rule
• Renamed Powershell Under Powershell Channel · sigma-rule
• Renamed ProcDump Execution · sigma-rule
• Renamed Schtasks Execution · sigma-rule
• Renamed SysInternals DebugView Execution · sigma-rule
• Renamed Sysinternals Sdelete Execution · sigma-rule
• Renamed Visual Studio Code Tunnel Execution · sigma-rule
• Renamed Vmnat.exe Execution · sigma-rule
• Renamed Whoami Execution · sigma-rule
• Renamed ZOHO Dctask64 Execution · sigma-rule
• Replace Desktop Wallpaper by Powershell · sigma-rule
• Replace.exe Usage · sigma-rule
• Replay Attack Detected · sigma-rule
• Response File Execution Via Odbcconf.EXE · sigma-rule
• Restricted Software Access By SRP · sigma-rule
• RestrictedAdminMode Registry Value Tampering · sigma-rule
• RestrictedAdminMode Registry Value Tampering - ProcCreation · sigma-rule
• Root Certificate Installed - PowerShell · sigma-rule
• Root Certificate Installed From Susp Locations · sigma-rule
• RottenPotato Like Attack Pattern · sigma-rule
• Ruby Inline Command Execution · sigma-rule
• Run Once Task Configuration in Registry · sigma-rule
• Run Once Task Execution as Configured in Registry · sigma-rule
• Run PowerShell Script from ADS · sigma-rule
• Run PowerShell Script from Redirected Input Stream · sigma-rule
• Rundll32 Execution With Uncommon DLL Extension · sigma-rule
• Rundll32 Execution Without CommandLine Parameters · sigma-rule
• Rundll32 Execution Without Parameters · sigma-rule
• Rundll32 InstallScreenSaver Execution · sigma-rule
• Rundll32 Internet Connection · sigma-rule
• Rundll32 Registered COM Objects · sigma-rule
• RunDLL32 Spawning Explorer · sigma-rule
• Rundll32 UNC Path Execution · sigma-rule
• RunMRU Registry Key Deletion · sigma-rule
• RunMRU Registry Key Deletion - Registry · sigma-rule
• Running Chrome VPN Extensions via the Registry 2 VPN Extension · sigma-rule
• SafeBoot Registry Key Deleted Via Reg.EXE · sigma-rule
• SAM Registry Hive Handle Request · sigma-rule
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · sigma-rule
• Scheduled Task Creation Masquerading as System Processes · sigma-rule
• Scheduled Task Creation Via Schtasks.EXE · sigma-rule
• Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
• Scheduled Task Executed From A Suspicious Location · sigma-rule
• Scheduled Task Executed Uncommon LOLBIN · sigma-rule
• Scheduled Task Executing Encoded Payload from Registry · sigma-rule
• Scheduled Task Executing Payload from Registry · sigma-rule
• Scheduled TaskCache Change by Uncommon Program · sigma-rule
• Schtasks Creation Or Modification With SYSTEM Privileges · sigma-rule
• Schtasks From Suspicious Folders · sigma-rule
• SCM Database Handle Failure · sigma-rule
• SCM Database Privileged Operation · sigma-rule
• SCR File Write Event · sigma-rule
• Screen Capture Activity Via Psr.EXE · sigma-rule
• ScreenConnect Temporary Installation Artefact · sigma-rule
• ScreenSaver Registry Key Set · sigma-rule
• Script Event Consumer Spawning Process · sigma-rule
• Script Interpreter Execution From Suspicious Folder · sigma-rule
• Script Interpreter Spawning Credential Scanner - Windows · sigma-rule
• Scripted Diagnostics Turn Off Check Enabled - Registry · sigma-rule
• Scripting/CommandLine Process Spawned Regsvr32 · sigma-rule
• Sdclt Child Processes · sigma-rule
• Sdiagnhost Calling Suspicious Child Process · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Process · sigma-rule
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set · sigma-rule
• Security Eventlog Cleared · sigma-rule
• Security Privileges Enumeration Via Whoami.EXE · sigma-rule
• Security Service Disabled Via Reg.EXE · sigma-rule
• Security Software Discovery Via Powershell Script · sigma-rule
• Security Support Provider (SSP) Added to LSA Configuration · sigma-rule
• Security Tools Keyword Lookup Via Findstr.EXE · sigma-rule
• Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location · sigma-rule
• Self Extraction Directive File Created In Potentially Suspicious Location · sigma-rule
• Sensitive File Access Via Volume Shadow Copy Backup · sigma-rule
• Sensitive File Dump Via Print.EXE · sigma-rule
• Sensitive File Dump Via Wbadmin.EXE · sigma-rule
• Sensitive File Recovery From Backup Via Wbadmin.EXE · sigma-rule
• Service Binary in Suspicious Folder · sigma-rule
• Service DACL Abuse To Hide Services Via Sc.EXE · sigma-rule
• Service Installation in Suspicious Folder · sigma-rule
• Service Installation with Suspicious Folder Pattern · sigma-rule
• Service Installed By Unusual Client - Security · sigma-rule
• Service Installed By Unusual Client - System · sigma-rule
• Service Reconnaissance Via Wmic.EXE · sigma-rule
• Service Registry Key Deleted Via Reg.EXE · sigma-rule
• Service Registry Key Read Access Request · sigma-rule
• Service Registry Permissions Weakness Check · sigma-rule
• Service Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Service Started/Stopped Via Wmic.EXE · sigma-rule
• Service Startup Type Change Via Wmic.EXE · sigma-rule
• Service StartupType Change Via PowerShell Set-Service · sigma-rule
• Service StartupType Change Via Sc.EXE · sigma-rule
• ServiceDll Hijack · sigma-rule
• Session Manager Autorun Keys Modification · sigma-rule
• Set Suspicious Files as System Files Using Attrib.EXE · sigma-rule
• Setup16.EXE Execution With Custom .Lst File · sigma-rule
• Shadow Copies Creation Using Operating Systems Utilities · sigma-rule
• Shadow Copies Deletion Using Operating Systems Utilities · sigma-rule
• Share And Session Enumeration Using Net.EXE · sigma-rule
• Shell Open Registry Keys Manipulation · sigma-rule
• Shell32 DLL Execution in Suspicious Directory · sigma-rule
• ShimCache Flush · sigma-rule
• Silence.EDA Detection · sigma-rule
• Silenttrinity Stager Msbuild Activity · sigma-rule
• Sliver C2 Default Service Installation · sigma-rule
• SMB Create Remote File Admin Share · sigma-rule
• smbexec.py Service Installation · sigma-rule
• SQL Client Tools PowerShell Session Detection · sigma-rule
• SQLite Chromium Profile Data DB Access · sigma-rule
• SQLite Firefox Profile Data DB Access · sigma-rule
• Start Windows Service Via Net.EXE · sigma-rule
• Startup Folder File Write · sigma-rule
• Startup/Logon Script Added to Group Policy Object · sigma-rule
• Sticky Key Like Backdoor Execution · sigma-rule
• Sticky Key Like Backdoor Usage - Registry · sigma-rule
• Stop Windows Service Via Net.EXE · sigma-rule
• Stop Windows Service Via PowerShell Stop-Service · sigma-rule
• Stop Windows Service Via Sc.EXE · sigma-rule
• Successful Account Login Via WMI · sigma-rule
• Successful Overpass the Hash Attempt · sigma-rule
• Suspect Svchost Activity · sigma-rule
• Suspicious Access to Sensitive File Extensions · sigma-rule
• Suspicious Active Directory Database Snapshot Via ADExplorer · sigma-rule
• Suspicious AddinUtil.EXE CommandLine Execution · sigma-rule
• Suspicious AgentExecutor PowerShell Execution · sigma-rule
• Suspicious Appended Extension · sigma-rule
• Suspicious Application Allowed Through Exploit Guard · sigma-rule
• Suspicious ArcSOC.exe Child Process · sigma-rule
• Suspicious ASPX File Drop by Exchange · sigma-rule
• Suspicious Autorun Registry Modified via WMI · sigma-rule
• Suspicious Binaries and Scripts in Public Folder · sigma-rule
• Suspicious Binary In User Directory Spawned From Office Application · sigma-rule
• Suspicious Binary Writes Via AnyDesk · sigma-rule
• Suspicious BitLocker Access Agent Update Utility Execution · sigma-rule
• Suspicious Cabinet File Execution Via Msdt.EXE · sigma-rule
• Suspicious Calculator Usage · sigma-rule
• Suspicious Camera and Microphone Access · sigma-rule
• Suspicious CertReq Command to Download · sigma-rule
• Suspicious Child Process Created as System · sigma-rule
• Suspicious Child Process of AspNetCompiler · sigma-rule
• Suspicious Child Process Of BgInfo.EXE · sigma-rule
• Suspicious Child Process Of Manage Engine ServiceDesk · sigma-rule
• Suspicious Child Process of Notepad++ Updater - GUP.Exe · sigma-rule
• Suspicious Child Process Of SQL Server · sigma-rule
• Suspicious Child Process Of Wermgr.EXE · sigma-rule
• Suspicious Chromium Browser Instance Executed With Custom Extension · sigma-rule
• Suspicious ClickFix/FileFix Execution Pattern · sigma-rule
• Suspicious Cobalt Strike DNS Beaconing - DNS Client · sigma-rule
• Suspicious Cobalt Strike DNS Beaconing - Sysmon · sigma-rule
• Suspicious CodePage Switch Via CHCP · sigma-rule
• Suspicious Command Patterns In Scheduled Task Creation · sigma-rule
• Suspicious Computer Machine Password by PowerShell · sigma-rule
• Suspicious Connection to Remote Account · sigma-rule
• Suspicious Control Panel DLL Load · sigma-rule
• Suspicious Copy From or To System Directory · sigma-rule
• Suspicious Creation with Colorcpl · sigma-rule
• Suspicious Csi.exe Usage · sigma-rule
• Suspicious Curl.EXE Download · sigma-rule
• Suspicious CustomShellHost Execution · sigma-rule
• Suspicious Debugger Registration Cmdline · sigma-rule
• Suspicious Deno File Written from Remote Source · sigma-rule
• Suspicious Desktopimgdownldr Command · sigma-rule
• Suspicious Desktopimgdownldr Target File · sigma-rule
• Suspicious Diantz Alternate Data Stream Execution · sigma-rule
• Suspicious Diantz Download and Compress Into a CAB File · sigma-rule
• Suspicious DLL Loaded via CertOC.EXE · sigma-rule
• Suspicious DNS Query for IP Lookup Service APIs · sigma-rule
• Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing · sigma-rule
• Suspicious DotNET CLR Usage Log Artifact · sigma-rule
• Suspicious Double Extension File Execution · sigma-rule
• Suspicious Double Extension Files · sigma-rule
• Suspicious Download From Direct IP Via Bitsadmin · sigma-rule
• Suspicious Download From File-Sharing Website Via Bitsadmin · sigma-rule
• Suspicious Download from Office Domain · sigma-rule
• Suspicious Download Via Certutil.EXE · sigma-rule
• Suspicious Driver Install by pnputil.exe · sigma-rule
• Suspicious Driver/DLL Installation Via Odbcconf.EXE · sigma-rule
• Suspicious Dropbox API Usage · sigma-rule
• Suspicious DumpMinitool Execution · sigma-rule
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call · sigma-rule
• Suspicious Encoded PowerShell Command Line · sigma-rule
• Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
• Suspicious Eventlog Clear · sigma-rule
• Suspicious Eventlog Clearing or Configuration Change Activity · sigma-rule
• Suspicious Executable File Creation · sigma-rule
• Suspicious Execution From Outlook Temporary Folder · sigma-rule
• Suspicious Execution of Hostname · sigma-rule
• Suspicious Execution of Powershell with Base64 · sigma-rule
• Suspicious Execution Of Renamed Sysinternals Tools - Registry · sigma-rule
• Suspicious Execution of Shutdown · sigma-rule
• Suspicious Execution of Shutdown to Log Out · sigma-rule
• Suspicious Execution of Systeminfo · sigma-rule
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix · sigma-rule
• Suspicious Extrac32 Alternate Data Stream Execution · sigma-rule
• Suspicious Extrac32 Execution · sigma-rule
• Suspicious File Access to Browser Credential Storage · sigma-rule
• Suspicious File Characteristics Due to Missing Fields · sigma-rule
• Suspicious File Created by ArcSOC.exe · sigma-rule
• Suspicious File Created in Outlook Temporary Directory · sigma-rule
• Suspicious File Created In PerfLogs · sigma-rule
• Suspicious File Download From File Sharing Websites - File Stream · sigma-rule
• Suspicious File Downloaded From Direct IP Via Certutil.EXE · sigma-rule
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE · sigma-rule
• Suspicious File Drop by Exchange · sigma-rule
• Suspicious File Encoded To Base64 Via Certutil.EXE · sigma-rule
• Suspicious File Execution From Internet Hosted WebDav Share · sigma-rule
• Suspicious File Write to SharePoint Layouts Directory · sigma-rule
• Suspicious File Write to Webapps Root Directory · sigma-rule
• Suspicious FileFix Execution Pattern · sigma-rule
• Suspicious Files in Default GPO Folder · sigma-rule
• Suspicious FromBase64String Usage On Gzip Archive - Process Creation · sigma-rule
• Suspicious FromBase64String Usage On Gzip Archive - Ps Script · sigma-rule
• Suspicious Get Information for SMB Share · sigma-rule
• Suspicious Get Information for SMB Share - PowerShell Module · sigma-rule
• Suspicious Get Local Groups Information · sigma-rule
• Suspicious Get Local Groups Information - PowerShell · sigma-rule
• Suspicious Get-ADDBAccount Usage · sigma-rule
• Suspicious Get-ADReplAccount · sigma-rule
• Suspicious Get-Variable.exe Creation · sigma-rule
• Suspicious GetTypeFromCLSID ShellExecute · sigma-rule
• Suspicious Git Clone · sigma-rule
• Suspicious GPO Discovery With Get-GPO · sigma-rule
• Suspicious Greedy Compression Using Rar.EXE · sigma-rule
• Suspicious Group And Account Reconnaissance Activity Using Net.EXE · sigma-rule
• Suspicious GrpConv Execution · sigma-rule
• Suspicious GUP Usage · sigma-rule
• Suspicious HH.EXE Execution · sigma-rule
• Suspicious High IntegrityLevel Conhost Legacy Option · sigma-rule
• Suspicious HWP Sub Processes · sigma-rule
• Suspicious Hyper-V Cmdlets · sigma-rule
• Suspicious IIS Module Registration · sigma-rule
• Suspicious Interactive PowerShell as SYSTEM · sigma-rule
• Suspicious Invoke-Item From Mount-DiskImage · sigma-rule
• Suspicious Invoke-WebRequest Execution · sigma-rule
• Suspicious Invoke-WebRequest Execution With DirectIP · sigma-rule
• Suspicious IO.FileStream · sigma-rule
• Suspicious JavaScript Execution Via Mshta.EXE · sigma-rule
• Suspicious Kerberos RC4 Ticket Encryption · sigma-rule
• Suspicious Kerberos Ticket Request via CLI · sigma-rule
• Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock · sigma-rule
• Suspicious Kernel Dump Using Dtrace · sigma-rule
• Suspicious Key Manager Access · sigma-rule
• Suspicious Keyboard Layout Load · sigma-rule
• Suspicious LDAP-Attributes Used · sigma-rule
• Suspicious LNK Command-Line Padding with Whitespace Characters · sigma-rule
• Suspicious LNK Double Extension File Created · sigma-rule
• Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location · sigma-rule
• Suspicious LSASS Access Via MalSecLogon · sigma-rule
• Suspicious Manipulation Of Default Accounts Via Net.EXE · sigma-rule
• Suspicious Microsoft Office Child Process · sigma-rule
• Suspicious Microsoft OneNote Child Process · sigma-rule
• Suspicious Modification Of Scheduled Tasks · sigma-rule
• Suspicious Mount-DiskImage · sigma-rule
• Suspicious MSDT Parent Process · sigma-rule
• Suspicious MSExchangeMailboxReplication ASPX Write · sigma-rule
• Suspicious MSHTA Child Process · sigma-rule
• Suspicious Mshta.EXE Execution Patterns · sigma-rule
• Suspicious MsiExec Embedding Parent · sigma-rule
• Suspicious Msiexec Execute Arbitrary DLL · sigma-rule
• Suspicious Msiexec Quiet Install From Remote Location · sigma-rule
• Suspicious Mstsc.EXE Execution With Local RDP File · sigma-rule
• Suspicious Network Command · sigma-rule
• Suspicious Network Connection to IP Lookup Service APIs · sigma-rule
• Suspicious New Service Creation · sigma-rule
• Suspicious New-PSDrive to Admin Share · sigma-rule
• Suspicious Non PowerShell WSMAN COM Provider · sigma-rule
• Suspicious Non-Browser Network Communication With Google API · sigma-rule
• Suspicious Non-Browser Network Communication With Telegram API · sigma-rule
• Suspicious NTLM Authentication on the Printer Spooler Service · sigma-rule
• Suspicious Outbound SMTP Connections · sigma-rule
• Suspicious Outlook Child Process · sigma-rule
• Suspicious Outlook Macro Created · sigma-rule
• Suspicious Parent Double Extension File Execution · sigma-rule
• Suspicious Path In Keyboard Layout IME File Registry Value · sigma-rule
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Suspicious Ping/Del Command Combination · sigma-rule
• Suspicious Plink Port Forwarding · sigma-rule
• Suspicious PowerShell Download - PoshModule · sigma-rule
• Suspicious PowerShell Download - Powershell Script · sigma-rule
• Suspicious PowerShell Download and Execute Pattern · sigma-rule
• Suspicious PowerShell Encoded Command Patterns · sigma-rule
• Suspicious PowerShell Get Current User · sigma-rule
• Suspicious PowerShell IEX Execution Patterns · sigma-rule
• Suspicious PowerShell In Registry Run Keys · sigma-rule
• Suspicious PowerShell Invocation From Script Engines · sigma-rule
• Suspicious PowerShell Invocations - Generic · sigma-rule
• Suspicious PowerShell Invocations - Generic - PowerShell Module · sigma-rule
• Suspicious PowerShell Invocations - Specific · sigma-rule
• Suspicious PowerShell Invocations - Specific - PowerShell Module · sigma-rule
• Suspicious PowerShell Parameter Substring · sigma-rule
• Suspicious PowerShell Parent Process · sigma-rule
• Suspicious PowerShell WindowStyle Option · sigma-rule
• Suspicious Printer Driver Empty Manufacturer · sigma-rule
• Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze · sigma-rule
• Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs · sigma-rule
• Suspicious Process By Web Server Process · sigma-rule
• Suspicious Process Created Via Wmic.EXE · sigma-rule
• Suspicious Process Discovery With Get-Process · sigma-rule
• Suspicious Process Masquerading As SvcHost.EXE · sigma-rule
• Suspicious Process Parents · sigma-rule
• Suspicious Process Patterns NTDS.DIT Exfil · sigma-rule
• Suspicious Process Start Locations · sigma-rule
• Suspicious Processes Spawned by WinRM · sigma-rule
• Suspicious PROCEXP152.sys File Created In TMP · sigma-rule
• Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE · sigma-rule
• Suspicious Program Names · sigma-rule
• Suspicious Provlaunch.EXE Child Process · sigma-rule
• Suspicious PsExec Execution · sigma-rule
• Suspicious Query of MachineGUID · sigma-rule
• Suspicious RASdial Activity · sigma-rule
• Suspicious RDP Redirect Using TSCON · sigma-rule
• Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet · sigma-rule
• Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
• Suspicious Recursive Takeown · sigma-rule
• Suspicious Redirection to Local Admin Share · sigma-rule
• Suspicious Reg Add BitLocker · sigma-rule
• Suspicious Registry Modification From ADS Via Regini.EXE · sigma-rule
• Suspicious Regsvr32 Execution From Remote Share · sigma-rule
• Suspicious Rejected SMB Guest Logon From IP · sigma-rule
• Suspicious Remote Child Process From Outlook · sigma-rule
• Suspicious Remote Logon with Explicit Credentials · sigma-rule
• Suspicious Renamed Comsvcs DLL Loaded By Rundll32 · sigma-rule
• Suspicious Response File Execution Via Odbcconf.EXE · sigma-rule
• Suspicious Run Key from Download · sigma-rule
• Suspicious Rundll32 Activity Invoking Sys File · sigma-rule
• Suspicious Rundll32 Execution With Image Extension · sigma-rule
• Suspicious Rundll32 Invoking Inline VBScript · sigma-rule
• Suspicious Rundll32 Setupapi.dll Activity · sigma-rule
• Suspicious Runscripthelper.exe · sigma-rule
• Suspicious Scan Loop Network · sigma-rule
• Suspicious Scheduled Task Creation · sigma-rule
• Suspicious Scheduled Task Creation Involving Temp Folder · sigma-rule
• Suspicious Scheduled Task Creation via Masqueraded XML File · sigma-rule
• Suspicious Scheduled Task Name As GUID · sigma-rule
• Suspicious Scheduled Task Update · sigma-rule
• Suspicious Scheduled Task Write to System32 Tasks · sigma-rule
• Suspicious Schtasks Execution AppData Folder · sigma-rule
• Suspicious Schtasks Schedule Type With High Privileges · sigma-rule
• Suspicious Schtasks Schedule Types · sigma-rule
• Suspicious ScreenSave Change by Reg.exe · sigma-rule
• Suspicious Screensaver Binary File Creation · sigma-rule
• Suspicious Scripting in a WMI Consumer · sigma-rule
• Suspicious Serv-U Process Pattern · sigma-rule
• Suspicious Service Binary Directory · sigma-rule
• Suspicious Service DACL Modification Via Set-Service Cmdlet · sigma-rule
• Suspicious Service DACL Modification Via Set-Service Cmdlet - PS · sigma-rule
• Suspicious Service Installation · sigma-rule
• Suspicious Service Installation Script · sigma-rule
• Suspicious Service Installed · sigma-rule
• Suspicious Service Path Modification · sigma-rule
• Suspicious Shell Open Command Registry Modification · sigma-rule
• Suspicious ShellExec_RunDLL Call Via Ordinal · sigma-rule
• Suspicious Shim Database Patching Activity · sigma-rule
• Suspicious Space Characters in RunMRU Registry Path - ClickFix · sigma-rule
• Suspicious Space Characters in TypedPaths Registry Path - FileFix · sigma-rule
• Suspicious Speech Runtime Binary Child Process · sigma-rule
• Suspicious Splwow64 Without Params · sigma-rule
• Suspicious Spool Service Child Process · sigma-rule
• Suspicious SSL Connection · sigma-rule
• Suspicious Start-Process PassThru · sigma-rule
• Suspicious Startup Folder Persistence · sigma-rule
• Suspicious Svchost Process Access · sigma-rule
• Suspicious SysAidServer Child · sigma-rule
• Suspicious SYSTEM User Process Creation · sigma-rule
• Suspicious SYSVOL Domain Group Policy Access · sigma-rule
• Suspicious TCP Tunnel Via PowerShell Script · sigma-rule
• Suspicious Teams Application Related ObjectAcess Event · sigma-rule
• Suspicious TSCON Start as SYSTEM · sigma-rule
• Suspicious UltraVNC Execution · sigma-rule
• Suspicious Unblock-File · sigma-rule
• Suspicious Uninstall of Windows Defender Feature via PowerShell · sigma-rule
• Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded · sigma-rule
• Suspicious Unsigned Thor Scanner Execution · sigma-rule
• Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) · sigma-rule
• Suspicious Usage of For Loop with Recursive Directory Search in CMD · sigma-rule
• Suspicious Use of CSharp Interactive Console · sigma-rule
• Suspicious Use of PsLogList · sigma-rule
• Suspicious Userinit Child Process · sigma-rule
• Suspicious VBoxDrvInst.exe Parameters · sigma-rule
• Suspicious Velociraptor Child Process · sigma-rule
• Suspicious Volume Shadow Copy VSS_PS.dll Load · sigma-rule
• Suspicious Volume Shadow Copy Vssapi.dll Load · sigma-rule
• Suspicious Vsls-Agent Command With AgentExtensionPath Load · sigma-rule
• Suspicious WebDav Client Execution Via Rundll32.EXE · sigma-rule
• Suspicious Where Execution · sigma-rule
• Suspicious Windows ANONYMOUS LOGON Local Account Created · sigma-rule
• Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE · sigma-rule
• Suspicious Windows Defender Registry Key Tampering Via Reg.EXE · sigma-rule
• Suspicious Windows Service Tampering · sigma-rule
• Suspicious Windows Trace ETW Session Tamper Via Logman.EXE · sigma-rule
• Suspicious Windows Update Agent Empty Cmdline · sigma-rule
• Suspicious WMIC Execution Via Office Process · sigma-rule
• Suspicious WmiPrvSE Child Process · sigma-rule
• Suspicious WSMAN Provider Image Loads · sigma-rule
• Suspicious X509Enrollment - Process Creation · sigma-rule
• Suspicious X509Enrollment - Ps Script · sigma-rule
• Suspicious XOR Encoded PowerShell Command · sigma-rule
• Suspicious ZipExec Execution · sigma-rule
• SyncAppvPublishingServer Bypass Powershell Restriction - PS Module · sigma-rule
• SyncAppvPublishingServer Execute Arbitrary PowerShell Code · sigma-rule
• SyncAppvPublishingServer Execution to Bypass Powershell Restriction · sigma-rule
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code · sigma-rule
• Sysinternals PsService Execution · sigma-rule
• Sysinternals PsSuspend Execution · sigma-rule
• Sysinternals PsSuspend Suspicious Execution · sigma-rule
• SysKey Registry Keys Access · sigma-rule
• Sysmon Application Crashed · sigma-rule
• Sysmon Channel Reference Deletion · sigma-rule
• Sysmon Configuration Error · sigma-rule
• Sysmon Configuration Modification · sigma-rule
• Sysmon Configuration Update · sigma-rule
• Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE · sigma-rule
• Sysmon Driver Altitude Change · sigma-rule
• Sysmon Driver Unloaded Via Fltmc.EXE · sigma-rule
• Sysprep on AppData Folder · sigma-rule
• System Control Panel Item Loaded From Uncommon Location · sigma-rule
• System Disk And Volume Reconnaissance Via Wmic.EXE · sigma-rule
• System File Execution Location Anomaly · sigma-rule
• System Information Discovery via Registry Queries · sigma-rule
• System Language Discovery via Reg.Exe · sigma-rule
• System Network Connections Discovery Via Net.EXE · sigma-rule
• System Restore Registry Modification via CommandLine · sigma-rule
• System Scripts Autorun Keys Modification · sigma-rule
• T1047 Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• TacticalRMM Service Installation · sigma-rule
• Tamper Windows Defender - PSClassic · sigma-rule
• Tamper Windows Defender - ScriptBlockLogging · sigma-rule
• Tamper Windows Defender Remove-MpPreference · sigma-rule
• Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging · sigma-rule
• Tamper With Sophos AV Registry Keys · sigma-rule
• Tap Driver Installation · sigma-rule
• Tap Driver Installation - Security · sigma-rule
• Tap Installer Execution · sigma-rule
• Taskkill Symantec Endpoint Protection · sigma-rule
• Taskmgr as LOCAL_SYSTEM · sigma-rule
• Tasks Folder Evasion · sigma-rule
• TeamViewer Domain Query By Non-TeamViewer Application · sigma-rule
• TeamViewer Log File Deleted · sigma-rule
• TeamViewer Remote Session · sigma-rule
• Terminal Server Client Connection History Cleared - Registry · sigma-rule
• Terminal Service Process Spawn · sigma-rule
• Testing Usage of Uncommonly Used Port · sigma-rule
• The Windows Defender Firewall Service Failed To Load Group Policy · sigma-rule
• Third Party Software DLL Sideloading · sigma-rule
• Time Travel Debugging Utility Usage · sigma-rule
• Time Travel Debugging Utility Usage - Image · sigma-rule
• Tomcat WebServer Logs Deleted · sigma-rule
• Tor Client/Browser Execution · sigma-rule
• Transferring Files with Credential Data via Network Shares · sigma-rule
• Troubleshooting Pack Cmdlet Execution · sigma-rule
• Trust Access Disable For VBApplications · sigma-rule
• Trusted Path Bypass via Windows Directory Spoofing · sigma-rule
• TrustedPath UAC Bypass Pattern · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - File · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - Process · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - Registry · sigma-rule
• UAC Bypass Tools Using ComputerDefaults · sigma-rule
• UAC Bypass Using .NET Code Profiler on MMC · sigma-rule
• UAC Bypass Using ChangePK and SLUI · sigma-rule
• UAC Bypass Using Consent and Comctl32 - File · sigma-rule
• UAC Bypass Using Consent and Comctl32 - Process · sigma-rule
• UAC Bypass Using Disk Cleanup · sigma-rule
• UAC Bypass Using DismHost · sigma-rule
• UAC Bypass Using IDiagnostic Profile · sigma-rule
• UAC Bypass Using IDiagnostic Profile - File · sigma-rule
• UAC Bypass Using IEInstal - File · sigma-rule
• UAC Bypass Using IEInstal - Process · sigma-rule
• UAC Bypass Using Iscsicpl - ImageLoad · sigma-rule
• UAC Bypass Using MSConfig Token Modification - File · sigma-rule
• UAC Bypass Using MSConfig Token Modification - Process · sigma-rule
• UAC Bypass Using NTFS Reparse Point - File · sigma-rule
• UAC Bypass Using NTFS Reparse Point - Process · sigma-rule
• UAC Bypass Using PkgMgr and DISM · sigma-rule
• UAC Bypass Using Windows Media Player - File · sigma-rule
• UAC Bypass Using Windows Media Player - Process · sigma-rule
• UAC Bypass Using Windows Media Player - Registry · sigma-rule
• UAC Bypass Using WOW64 Logger DLL Hijack · sigma-rule
• UAC Bypass via Event Viewer · sigma-rule
• UAC Bypass via ICMLuaUtil · sigma-rule
• UAC Bypass via Sdclt · sigma-rule
• UAC Bypass via Windows Firewall Snap-In Hijack · sigma-rule
• UAC Bypass Via Wsreset · sigma-rule
• UAC Bypass With Fake DLL · sigma-rule
• UAC Bypass WSReset · sigma-rule
• UAC Disabled · sigma-rule
• UAC Notification Disabled · sigma-rule
• UAC Secure Desktop Prompt Disabled · sigma-rule
• UEFI Persistence Via Wpbbin - FileCreation · sigma-rule
• UEFI Persistence Via Wpbbin - ProcessCreation · sigma-rule
• Unauthorized System Time Modification · sigma-rule
• Uncommon Assistive Technology Applications Execution Via AtBroker.EXE · sigma-rule
• Uncommon AddinUtil.EXE CommandLine Execution · sigma-rule
• Uncommon Child Process Of AddinUtil.EXE · sigma-rule
• Uncommon Child Process Of Appvlp.EXE · sigma-rule
• Uncommon Child Process Of BgInfo.EXE · sigma-rule
• Uncommon Child Process Of Conhost.EXE · sigma-rule
• Uncommon Child Process Of Defaultpack.EXE · sigma-rule
• Uncommon Child Process Of Setres.EXE · sigma-rule
• Uncommon Child Process Spawned By Odbcconf.EXE · sigma-rule
• Uncommon Connection to Active Directory Web Services · sigma-rule
• Uncommon Extension In Keyboard Layout IME File Registry Value · sigma-rule
• Uncommon Extension Shim Database Installation Via Sdbinst.EXE · sigma-rule
• Uncommon File Created by Notepad++ Updater Gup.EXE · sigma-rule
• Uncommon File Created In Office Startup Folder · sigma-rule
• Uncommon Link.EXE Parent Process · sigma-rule
• Uncommon Microsoft Office Trusted Location Added · sigma-rule
• Uncommon Network Connection Initiated By Certutil.EXE · sigma-rule
• Uncommon New Firewall Rule Added In Windows Firewall Exception List · sigma-rule
• Uncommon One Time Only Scheduled Task At 00:00 · sigma-rule
• Uncommon Outbound Kerberos Connection · sigma-rule
• Uncommon Outbound Kerberos Connection - Security · sigma-rule
• Uncommon Process Access Rights For Target Image · sigma-rule
• Uncommon Service Installation Image Path · sigma-rule
• Uncommon Sigverif.EXE Child Process · sigma-rule
• Uncommon Svchost Command Line Parameter · sigma-rule
• Uncommon Svchost Parent Process · sigma-rule
• Uncommon System Information Discovery Via Wmic.EXE · sigma-rule
• Uncommon Userinit Child Process · sigma-rule
• Uninstall Crowdstrike Falcon Sensor · sigma-rule
• Uninstall Sysinternals Sysmon · sigma-rule
• Unmount Share Via Net.EXE · sigma-rule
• Unsigned .node File Loaded · sigma-rule
• Unsigned Binary Loaded From Suspicious Location · sigma-rule
• Unsigned DLL Loaded by Windows Utility · sigma-rule
• Unsigned Image Loaded Into LSASS Process · sigma-rule
• Unsigned Mfdetours.DLL Sideloading · sigma-rule
• Unsigned Module Loaded by ClickOnce Application · sigma-rule
• Unsigned or Unencrypted SMB Connection to Share Established · sigma-rule
• Unusual Child Process of dns.exe · sigma-rule
• Unusual File Deletion by Dns.exe · sigma-rule
• Unusual File Download from Direct IP Address · sigma-rule
• Unusual File Download From File Sharing Websites - File Stream · sigma-rule
• Unusual File Modification by dns.exe · sigma-rule
• Unusual Parent Process For Cmd.EXE · sigma-rule
• Usage of Renamed Sysinternals Tools - RegistrySet · sigma-rule
• Usage Of Web Request Commands And Cmdlets · sigma-rule
• Usage Of Web Request Commands And Cmdlets - ScriptBlock · sigma-rule
• USB Device Plugged · sigma-rule
• Use Get-NetTCPConnection · sigma-rule
• Use Get-NetTCPConnection - PowerShell Module · sigma-rule
• Use Icacls to Hide File to Everyone · sigma-rule
• Use NTFS Short Name in Command Line · sigma-rule
• Use NTFS Short Name in Image · sigma-rule
• Use of FSharp Interpreters · sigma-rule
• Use of OpenConsole · sigma-rule
• Use of Pcalua For Execution · sigma-rule
• Use of Remote.exe · sigma-rule
• Use of Scriptrunner.exe · sigma-rule
• Use Of The SFTP.EXE Binary As A LOLBIN · sigma-rule
• Use of TTDInject.exe · sigma-rule
• Use of UltraVNC Remote Access Software · sigma-rule
• Use of VisualUiaVerifyNative.exe · sigma-rule
• Use of VSIISExeLauncher.exe · sigma-rule
• Use of W32tm as Timer · sigma-rule
• Use of Wfc.exe · sigma-rule
• Use Short Name Path in Image · sigma-rule
• User Added To Highly Privileged Group · sigma-rule
• User Added to Local Administrator Group · sigma-rule
• User Added to Local Administrators Group · sigma-rule
• User Added to Remote Desktop Users Group · sigma-rule
• User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell · sigma-rule
• User Logoff Event · sigma-rule
• User Shell Folders Registry Modification via CommandLine · sigma-rule
• Using SettingSyncHost.exe as LOLBin · sigma-rule
• UtilityFunctions.ps1 Proxy Dll · sigma-rule
• VBA DLL Loaded Via Office Application · sigma-rule
• VBScript Payload Stored in Registry · sigma-rule
• Veeam Backup Database Suspicious Query · sigma-rule
• VeeamBackup Database Credentials Dump Via Sqlcmd.EXE · sigma-rule
• Verclsid.exe Runs COM Object · sigma-rule
• VHD Image Download Via Browser · sigma-rule
• Virtualbox Driver Installation or Starting of VMs · sigma-rule
• Visual Basic Command Line Compiler Usage · sigma-rule
• Visual Studio Code Tunnel Execution · sigma-rule
• Visual Studio Code Tunnel Service Installation · sigma-rule
• Visual Studio Code Tunnel Shell Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Renamed Execution · sigma-rule
• VMGuestLib DLL Sideload · sigma-rule
• VMMap Signed Dbghelp.DLL Potential Sideloading · sigma-rule
• VMMap Unsigned Dbghelp.DLL Potential Sideloading · sigma-rule
• VMToolsd Suspicious Child Process · sigma-rule
• Volume Shadow Copy Mount · sigma-rule
• VolumeShadowCopy Symlink Creation Via Mklink · sigma-rule
• VsCode Powershell Profile Modification · sigma-rule
• VSSAudit Security Event Source Registration · sigma-rule
• Vulnerable Driver Blocklist Registry Tampering Via CommandLine · sigma-rule
• Vulnerable Driver Load · sigma-rule
• Vulnerable Driver Load By Name · sigma-rule
• Vulnerable HackSys Extreme Vulnerable Driver Load · sigma-rule
• Vulnerable Netlogon Secure Channel Connection Allowed · sigma-rule
• Vulnerable WinRing0 Driver Load · sigma-rule
• WCE wceaux.dll Access · sigma-rule
• Wdigest CredGuard Registry Modification · sigma-rule
• Wdigest Enable UseLogonCredential · sigma-rule
• Weak Encryption Enabled and Kerberoast · sigma-rule
• WebDav Client Execution Via Rundll32.EXE · sigma-rule
• Webshell Detection With Command Line Keywords · sigma-rule
• Webshell Hacking Activity Patterns · sigma-rule
• Webshell Tool Reconnaissance Activity · sigma-rule
• WerFault LSASS Process Memory Dump · sigma-rule
• WFP Filter Added via Registry · sigma-rule
• WhoAmI as Parameter · sigma-rule
• Whoami.EXE Execution Anomaly · sigma-rule
• Whoami.EXE Execution From Privileged Process · sigma-rule
• Whoami.EXE Execution With Output Option · sigma-rule
• Win Defender Restored Quarantine File · sigma-rule
• Win Susp Computer Name Containing Samtheadmin · sigma-rule
• WinDivert Driver Load · sigma-rule
• Windows Admin Share Mount Via Net.EXE · sigma-rule
• Windows AMSI Related Registry Tampering Via CommandLine · sigma-rule
• Windows AppX Deployment Full Trust Package Installation · sigma-rule
• Windows AppX Deployment Unsigned Package Installation · sigma-rule
• Windows Backup Deleted Via Wbadmin.EXE · sigma-rule
• Windows Binaries Write Suspicious Extensions · sigma-rule
• Windows Binary Executed From WSL · sigma-rule
• Windows Credential Editor Registry · sigma-rule
• Windows Credential Guard Disabled - Registry · sigma-rule
• Windows Credential Guard Registry Tampering Via CommandLine · sigma-rule
• Windows Credential Guard Related Registry Value Deleted - Registry · sigma-rule
• Windows Credential Manager Access via VaultCmd · sigma-rule
• Windows Default Domain GPO Modification · sigma-rule
• Windows Default Domain GPO Modification via GPME · sigma-rule
• Windows Defender AMSI Trigger Detected · sigma-rule
• Windows Defender Configuration Changes · sigma-rule
• Windows Defender Context Menu Removed · sigma-rule
• Windows Defender Definition Files Removed · sigma-rule
• Windows Defender Exclusion List Modified · sigma-rule
• Windows Defender Exclusion Registry Key - Write Access Requested · sigma-rule
• Windows Defender Exclusions Added · sigma-rule
• Windows Defender Exclusions Added - PowerShell · sigma-rule
• Windows Defender Exclusions Added - Registry · sigma-rule
• Windows Defender Exploit Guard Tamper · sigma-rule
• Windows Defender Firewall Has Been Reset To Its Default Configuration · sigma-rule
• Windows Defender Grace Period Expired · sigma-rule
• Windows Defender Malware And PUA Scanning Disabled · sigma-rule
• Windows Defender Real-time Protection Disabled · sigma-rule
• Windows Defender Real-Time Protection Failure/Restart · sigma-rule
• Windows Defender Service Disabled - Registry · sigma-rule
• Windows Defender Submit Sample Feature Disabled · sigma-rule
• Windows Defender Threat Detected · sigma-rule
• Windows Defender Threat Detection Service Disabled · sigma-rule
• Windows Defender Threat Severity Default Action Modified · sigma-rule
• Windows Defender Virus Scanning Feature Disabled · sigma-rule
• Windows Event Auditing Disabled · sigma-rule
• Windows Event Log Access Tampering Via Registry · sigma-rule
• Windows EventLog Autologger Session Registry Modification Via CommandLine · sigma-rule
• Windows Filtering Platform Blocked Connection From EDR Agent Binary · sigma-rule
• Windows Firewall Disabled via PowerShell · sigma-rule
• Windows Firewall Profile Disabled · sigma-rule
• Windows Firewall Settings Have Been Changed · sigma-rule
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE · sigma-rule
• Windows Hypervisor Enforced Code Integrity Disabled · sigma-rule
• Windows Internet Hosted WebDav Share Mount Via Net.EXE · sigma-rule
• Windows MSIX Package Support Framework AI_STUBS Execution · sigma-rule
• Windows Network Access Suspicious desktop.ini Action · sigma-rule
• Windows Pcap Drivers · sigma-rule
• Windows Processes Suspicious Parent Directory · sigma-rule
• Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted · sigma-rule
• Windows Recall Feature Enabled - Registry · sigma-rule
• Windows Recall Feature Enabled Via Reg.EXE · sigma-rule
• Windows Recovery Environment Disabled Via Reagentc · sigma-rule
• Windows Registry Trust Record Modification · sigma-rule
• Windows Screen Capture with CopyFromScreen · sigma-rule
• Windows Share Mount Via Net.EXE · sigma-rule
• Windows Shell/Scripting Application File Write to Suspicious Folder · sigma-rule
• Windows Shell/Scripting Processes Spawning Suspicious Programs · sigma-rule
• Windows Terminal Profile Settings Modification By Uncommon Process · sigma-rule
• Windows Update Error · sigma-rule
• Windows Vulnerable Driver Blocklist Disabled · sigma-rule
• WINEKEY Registry Modification · sigma-rule
• Winlogon AllowMultipleTSSessions Enable · sigma-rule
• Winlogon Helper DLL · sigma-rule
• Winlogon Notify Key Logon Persistence · sigma-rule
• Winrar Compressing Dump Files · sigma-rule
• WinRAR Creating Files in Startup Locations · sigma-rule
• WinRAR Execution in Non-Standard Folder · sigma-rule
• Winrs Local Command Execution · sigma-rule
• WinSock2 Autorun Keys Modification · sigma-rule
• Wlrmdr.EXE Uncommon Argument Or Child Process · sigma-rule
• WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
• WMI Backdoor Exchange Transport Agent · sigma-rule
• WMI Event Consumer Created Named Pipe · sigma-rule
• WMI Event Subscription · sigma-rule
• WMI Persistence · sigma-rule
• WMI Persistence - Command Line Event Consumer · sigma-rule
• WMI Persistence - Script Event Consumer · sigma-rule
• WMI Persistence - Script Event Consumer File Write · sigma-rule
• WMI Persistence - Security · sigma-rule
• WMIC Loading Scripting Libraries · sigma-rule
• WMIC Remote Command Execution · sigma-rule
• WMIC Unquoted Services Path Lookup - PowerShell · sigma-rule
• Wmiexec Default Output File · sigma-rule
• WMImplant Hack Tool · sigma-rule
• WmiPrvSE Spawned A Process · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack - File · sigma-rule
• Wow6432Node Classes Autorun Keys Modification · sigma-rule
• Wow6432Node CurrentVersion Autorun Keys Modification · sigma-rule
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · sigma-rule
• Write Protect For Storage Disabled · sigma-rule
• Writing Local Admin Share · sigma-rule
• Writing Of Malicious Files To The Fonts Folder · sigma-rule
• WScript or CScript Dropper - File · sigma-rule
• Wscript Shell Run In CommandLine · sigma-rule
• WSL Child Process Anomaly · sigma-rule
• WSL Kali-Linux Usage · sigma-rule
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE · sigma-rule
• XSL Script Execution Via WMIC.EXE · sigma-rule
• Xwizard.EXE Execution From Non-Default Location · sigma-rule
• Zerologon Exploitation Using Well-known Tools · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Module · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Script · sigma-rule