medium — severity tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• 7Zip Compressing Dump Files · sigma-rule
• A New Trust Was Created To A Domain · sigma-rule
• A Rule Has Been Deleted From The Windows Firewall Exception List · sigma-rule
• Abusing Print Executable · sigma-rule
• Access of Sudoers File Content · sigma-rule
• Access to Browser Login Data · sigma-rule
• Access To Crypto Currency Wallets By Uncommon Applications · sigma-rule
• Access To Potentially Sensitive Sysvol Files By Uncommon Applications · sigma-rule
• Access To Windows Credential History File By Uncommon Applications · sigma-rule
• Access To Windows DPAPI Master Keys By Uncommon Applications · sigma-rule
• Account Disabled or Blocked for Sign in Attempts · sigma-rule
• Account Lockout · sigma-rule
• Account Tampering - Suspicious Failed Logon Reasons · sigma-rule
• Activate Suppression of Windows Security Center Notifications · sigma-rule
• Active Directory Database Snapshot Via ADExplorer · sigma-rule
• Active Directory Structure Export Via Csvde.EXE · sigma-rule
• Activity from Anonymous IP Addresses · sigma-rule
• Activity from Infrequent Country · sigma-rule
• Activity from Suspicious IP Addresses · sigma-rule
• Add DisallowRun Execution to Registry · sigma-rule
• Add New Download Source To Winget · sigma-rule
• Add Port Monitor Persistence in Registry · sigma-rule
• Add Potential Suspicious New Download Source To Winget · sigma-rule
• Added Owner To Application · sigma-rule
• AddinUtil.EXE Execution From Uncommon Directory · sigma-rule
• Addition of SID History to Active Directory Object · sigma-rule
• ADExplorer Writing Complete AD Snapshot Into .dat File · sigma-rule
• ADFS Database Named Pipe Connection By Uncommon Tool · sigma-rule
• ADS Zone.Identifier Deleted By Uncommon Application · sigma-rule
• ADSI-Cache File Creation By Uncommon Tool · sigma-rule
• Advanced IP Scanner - File Event · sigma-rule
• AgentExecutor PowerShell Execution · sigma-rule
• Allow RDP Remote Assistance Feature · sigma-rule
• Alternate PowerShell Hosts - PowerShell Module · sigma-rule
• Alternate PowerShell Hosts Pipe · sigma-rule
• Always Install Elevated MSI Spawned Cmd And Powershell · sigma-rule
• Always Install Elevated Windows Installer · sigma-rule
• Anydesk Temporary Artefact · sigma-rule
• Apache Threading Error · sigma-rule
• App Assigned To Azure RBAC/Microsoft Entra Role · sigma-rule
• Application Removed Via Wmic.EXE · sigma-rule
• Application Termination Attempt via Wmic.EXE · sigma-rule
• Application Using Device Code Authentication Flow · sigma-rule
• Applications That Are Using ROPC Authentication Flow · sigma-rule
• AppLocker Prevented Application or Script from Running · sigma-rule
• AppX Package Installation Attempts Via AppInstaller.EXE · sigma-rule
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE · sigma-rule
• Arbitrary File Download Via ConfigSecurityPolicy.EXE · sigma-rule
• Arbitrary File Download Via GfxDownloadWrapper.EXE · sigma-rule
• Arbitrary File Download Via MSEDGE_PROXY.EXE · sigma-rule
• Arbitrary File Download Via MSOHTMED.EXE · sigma-rule
• Arbitrary File Download Via MSPUB.EXE · sigma-rule
• Arbitrary File Download Via PresentationHost.EXE · sigma-rule
• Arbitrary File Download Via Squirrel.EXE · sigma-rule
• Arbitrary MSI Download Via Devinit.EXE · sigma-rule
• Arbitrary Shell Command Execution Via Settingcontent-Ms · sigma-rule
• AspNetCompiler Execution · sigma-rule
• Assembly Loading Via CL_LoadAssembly.ps1 · sigma-rule
• Atbroker Registry Change · sigma-rule
• Audio Capture via PowerShell · sigma-rule
• Audio Capture via SoundRecorder · sigma-rule
• Authentications To Important Apps Using Single Factor Authentication · sigma-rule
• Automated Collection Command PowerShell · sigma-rule
• Automated Collection Command Prompt · sigma-rule
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl · sigma-rule
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File · sigma-rule
• AWS CloudTrail Important Change · sigma-rule
• AWS Console GetSigninToken Potential Abuse · sigma-rule
• AWS ConsoleLogin Failed Authentication · sigma-rule
• AWS EC2 Disable EBS Encryption · sigma-rule
• AWS ECS Task Definition That Queries The Credential Endpoint · sigma-rule
• AWS EFS Fileshare Mount Modified or Deleted · sigma-rule
• AWS IAM Backdoor Users Keys · sigma-rule
• AWS Key Pair Import Activity · sigma-rule
• AWS RDS Master Password Change · sigma-rule
• AWS Root Credentials · sigma-rule
• AWS S3 Bucket Versioning Disable · sigma-rule
• AWS SAML Provider Deletion Activity · sigma-rule
• AWS Snapshot Backup Exfiltration · sigma-rule
• AWS STS GetCallerIdentity Enumeration Via TruffleHog · sigma-rule
• AWS Successful Console Login Without MFA · sigma-rule
• AWS Suspicious SAML Activity · sigma-rule
• Azure Active Directory Hybrid Health AD FS New Server · sigma-rule
• Azure Active Directory Hybrid Health AD FS Service Delete · sigma-rule
• Azure AD Health Monitoring Agent Registry Keys Access · sigma-rule
• Azure AD Health Service Agents Registry Keys Access · sigma-rule
• Azure Application Deleted · sigma-rule
• Azure Device or Configuration Modified or Deleted · sigma-rule
• Azure DNS Zone Modified or Deleted · sigma-rule
• Azure Domain Federation Settings Modified · sigma-rule
• Azure Firewall Modified or Deleted · sigma-rule
• Azure Firewall Rule Collection Modified or Deleted · sigma-rule
• Azure Key Vault Modified or Deleted · sigma-rule
• Azure Keyvault Key Modified or Deleted · sigma-rule
• Azure Keyvault Secrets Modified or Deleted · sigma-rule
• Azure Kubernetes Admission Controller · sigma-rule
• Azure Kubernetes CronJob · sigma-rule
• Azure Kubernetes Events Deleted · sigma-rule
• Azure Kubernetes Network Policy Change · sigma-rule
• Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted · sigma-rule
• Azure Kubernetes Secret or Config Object Access · sigma-rule
• Azure Kubernetes Sensitive Role Access · sigma-rule
• Azure Kubernetes Service Account Modified or Deleted · sigma-rule
• Azure Network Firewall Policy Modified or Deleted · sigma-rule
• Azure New CloudShell Created · sigma-rule
• Azure Unusual Authentication Interruption · sigma-rule
• Backup Catalog Deleted · sigma-rule
• Backup Files Deleted · sigma-rule
• Binary Proxy Execution Via Dotnet-Trace.EXE · sigma-rule
• Bitbucket Audit Log Configuration Updated · sigma-rule
• Bitbucket Global Permission Changed · sigma-rule
• Bitbucket Global Secret Scanning Rule Deleted · sigma-rule
• Bitbucket Global SSH Settings Changed · sigma-rule
• Bitbucket User Details Export Attempt Detected · sigma-rule
• Bitbucket User Login Failure · sigma-rule
• Bitbucket User Login Failure Via SSH · sigma-rule
• Bitbucket User Permissions Export Attempt · sigma-rule
• Bitlocker Key Retrieval · sigma-rule
• BITS Transfer Job Downloading File Potential Suspicious Extension · sigma-rule
• BITS Transfer Job With Uncommon Or Suspicious Remote TLD · sigma-rule
• Bpfdoor TCP Ports Redirect · sigma-rule
• BPFtrace Unsafe Option Usage · sigma-rule
• Browser Started with Remote Debugging · sigma-rule
• C# IL Code Compilation Via Ilasm.EXE · sigma-rule
• CA Policy Removed by Non Approved Actor · sigma-rule
• CA Policy Updated by Non Approved Actor · sigma-rule
• Capture Credentials with Rpcping.exe · sigma-rule
• Certificate Exported From Local Certificate Store · sigma-rule
• Certificate Exported Via Certutil.EXE · sigma-rule
• Certificate Exported Via PowerShell · sigma-rule
• Certificate Exported Via PowerShell - ScriptBlock · sigma-rule
• Certificate Private Key Acquired · sigma-rule
• Certificate-Based Authentication Enabled · sigma-rule
• Change PowerShell Policies to an Insecure Level · sigma-rule
• Change PowerShell Policies to an Insecure Level - PowerShell · sigma-rule
• Change to Authentication Method · sigma-rule
• Change User Agents with WebRequest · sigma-rule
• Changing Existing Service ImagePath Value Via Reg.EXE · sigma-rule
• Chmod Targeting Sensitive Directories · sigma-rule
• Chromium Browser Instance Executed With Custom Extension · sigma-rule
• Cisco Denial of Service · sigma-rule
• Cisco Dot1x Disabled · sigma-rule
• Cisco File Deletion · sigma-rule
• Cisco Modify Configuration · sigma-rule
• Cisco Show Commands Input · sigma-rule
• Cisco Sniffing · sigma-rule
• Classes Autorun Keys Modification · sigma-rule
• Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall · sigma-rule
• Clear PowerShell History - PowerShell · sigma-rule
• Clear PowerShell History - PowerShell Module · sigma-rule
• Clfs.SYS Loaded By Process Located In a Potential Suspicious Location · sigma-rule
• ClickOnce Trust Prompt Tampering · sigma-rule
• Clipboard Access Via OSAScript · sigma-rule
• Cloudflared Portable Execution · sigma-rule
• Cloudflared Quick Tunnel Execution · sigma-rule
• Cloudflared Tunnel Connections Cleanup · sigma-rule
• Cloudflared Tunnel Execution · sigma-rule
• Cloudflared Tunnels Related DNS Requests · sigma-rule
• CLR DLL Loaded Via Office Applications · sigma-rule
• Cmd Launched with Hidden Start Flags to Suspicious Targets · sigma-rule
• Code Execution via Pcwutl.dll · sigma-rule
• CodePage Modification Via MODE.COM To Russian Language · sigma-rule
• COM Hijacking via TreatAs · sigma-rule
• COM Object Execution via Xwizard.EXE · sigma-rule
• Command Line Execution with Suspicious URL and AppData Strings · sigma-rule
• Common Autorun Keys Modification · sigma-rule
• Communication To Uncommon Destination Ports · sigma-rule
• Compress Data and Lock With Password for Exfiltration With 7-ZIP · sigma-rule
• Compress Data and Lock With Password for Exfiltration With WINZIP · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet · sigma-rule
• Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell · sigma-rule
• Computer System Reconnaissance Via Wmic.EXE · sigma-rule
• Conhost Spawned By Uncommon Parent Process · sigma-rule
• Console CodePage Lookup Via CHCP · sigma-rule
• ConvertTo-SecureString Cmdlet Usage Via CommandLine · sigma-rule
• Copy From Or To Admin Share Or Sysvol Folder · sigma-rule
• Crash Dump Created By Operating System · sigma-rule
• CrashControl CrashDump Disabled · sigma-rule
• Created Files by Microsoft Sync Center · sigma-rule
• Creation Of An User Account · sigma-rule
• Creation Of Non-Existent System DLL · sigma-rule
• Creation Of Pod In System Namespace · sigma-rule
• Creation of WerFault.exe/Wer.dll in Unusual Folder · sigma-rule
• Credential Manager Access By Uncommon Applications · sigma-rule
• Credentials from Password Stores - Keychain · sigma-rule
• CredUI.DLL Loaded By Uncommon Process · sigma-rule
• CSExec Service File Creation · sigma-rule
• CSExec Service Installation · sigma-rule
• CurrentControlSet Autorun Keys Modification · sigma-rule
• CurrentVersion Autorun Keys Modification · sigma-rule
• CurrentVersion NT Autorun Keys Modification · sigma-rule
• Data Exfiltration to Unsanctioned Apps · sigma-rule
• Data Exfiltration with Wget · sigma-rule
• Data Export From MSSQL Table Via BCP.EXE · sigma-rule
• DCERPC SMB Spoolss Named Pipe · sigma-rule
• Deleted Data Overwritten Via Cipher.EXE · sigma-rule
• Denied Access To Remote Desktop · sigma-rule
• Deno Runtime Spawns Shell Or Scripting Interpreter · sigma-rule
• Desktop.INI Created by Uncommon Process · sigma-rule
• Detected Windows Software Discovery · sigma-rule
• Detected Windows Software Discovery - PowerShell · sigma-rule
• Detection of PowerShell Execution via Sqlps.exe · sigma-rule
• Device Installation Blocked · sigma-rule
• Device Registration or Join Without MFA · sigma-rule
• DeviceCredentialDeployment Execution · sigma-rule
• Direct Autorun Keys Modification · sigma-rule
• DirectorySearcher Powershell Exploitation · sigma-rule
• Disable Administrative Share Creation at Startup · sigma-rule
• Disable Exploit Guard Network Protection on Windows Defender · sigma-rule
• Disable Internal Tools or Feature in Registry · sigma-rule
• Disable Microsoft Defender Firewall via Registry · sigma-rule
• Disable Or Stop Services · sigma-rule
• Disable Privacy Settings Experience in Registry · sigma-rule
• Disable Security Tools · sigma-rule
• Disable Tamper Protection on Windows Defender · sigma-rule
• Disable Windows Firewall by Registry · sigma-rule
• Disable Windows Security Center Notifications · sigma-rule
• Disabled MFA to Bypass Authentication Mechanisms · sigma-rule
• Disabling Security Tools · sigma-rule
• Disabling Security Tools - Builtin · sigma-rule
• Disk Image Mounting Via Hdiutil - MacOS · sigma-rule
• Diskshadow Script Mode - Execution From Potential Suspicious Location · sigma-rule
• Diskshadow Script Mode - Uncommon Script Extension Execution · sigma-rule
• Dism Remove Online Package · sigma-rule
• Displaying Hidden Files Feature Disabled · sigma-rule
• Django Framework Exceptions · sigma-rule
• DLL Execution via Rasautou.exe · sigma-rule
• DLL Execution Via Register-cimprovider.exe · sigma-rule
• DLL Load By System Process From Suspicious Locations · sigma-rule
• DLL Loaded via CertOC.EXE · sigma-rule
• DllUnregisterServer Function Call Via Msiexec.EXE · sigma-rule
• DMSA Service Account Created in Specific OUs - PowerShell · sigma-rule
• DNS Query Request By Regsvr32.EXE · sigma-rule
• DNS Query To AzureWebsites.NET By Non-Browser Process · sigma-rule
• DNS Query To Common Malware Hosting and Shortener Services · sigma-rule
• DNS Query To Devtunnels Domain · sigma-rule
• DNS Query To MEGA Hosting Website · sigma-rule
• DNS Query To MEGA Hosting Website - DNS Client · sigma-rule
• DNS Query To Remote Access Software Domain From Non-Browser App · sigma-rule
• DNS Query To Visual Studio Code Tunnels Domain · sigma-rule
• DNS TOR Proxies · sigma-rule
• DNS-over-HTTPS Enabled by Registry · sigma-rule
• Domain Trust Discovery Via Dsquery · sigma-rule
• DotNET Assembly DLL Loaded Via Office Application · sigma-rule
• Download File To Potentially Suspicious Directory Via Wget · sigma-rule
• Download from Suspicious Dyndns Hosts · sigma-rule
• DPAPI Domain Master Key Backup Attempt · sigma-rule
• Driver/DLL Installation Via Odbcconf.EXE · sigma-rule
• Dropping Of Password Filter DLL · sigma-rule
• Dump Credentials from Windows Credential Manager With PowerShell · sigma-rule
• Dumping Process via Sqldumper.exe · sigma-rule
• DumpMinitool Execution · sigma-rule
• Dynamic .NET Compilation Via Csc.EXE · sigma-rule
• Elevated System Shell Spawned From Uncommon Parent Location · sigma-rule
• Enable Microsoft Dynamic Data Exchange · sigma-rule
• Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback · sigma-rule
• Enable Windows Remote Management · sigma-rule
• Enabling COR Profiler Environment Variables · sigma-rule
• End User Consent Blocked · sigma-rule
• Enumerate All Information With Whoami.EXE · sigma-rule
• Enumerate Credentials from Windows Credential Manager With PowerShell · sigma-rule
• Enumeration for 3rd Party Creds From CLI · sigma-rule
• Enumeration for Credentials in Registry · sigma-rule
• Esentutl Gather Credentials · sigma-rule
• Esentutl Steals Browser Information · sigma-rule
• ESXi Account Creation Via ESXCLI · sigma-rule
• ESXi Network Configuration Discovery Via ESXCLI · sigma-rule
• ESXi Storage Information Discovery Via ESXCLI · sigma-rule
• ESXi Syslog Configuration Change Via ESXCLI · sigma-rule
• ESXi System Information Discovery Via ESXCLI · sigma-rule
• ESXi VM Kill Via ESXCLI · sigma-rule
• ESXi VM List Discovery Via ESXCLI · sigma-rule
• ESXi VSAN Information Discovery Via ESXCLI · sigma-rule
• ETW Logging/Processing Option Disabled On IIS Server · sigma-rule
• Eventlog Cleared · sigma-rule
• EventLog EVTX File Deleted · sigma-rule
• EVTX Created In Uncommon Location · sigma-rule
• Executable from Webdav · sigma-rule
• Execute Code with Pester.bat · sigma-rule
• Execute Code with Pester.bat as Parent · sigma-rule
• Execute Files with Msdeploy.exe · sigma-rule
• Execute From Alternate Data Streams · sigma-rule
• Execute Invoke-command on Remote Host · sigma-rule
• Explorer Process Tree Break · sigma-rule
• External Remote RDP Logon from Public IP · sigma-rule
• Extracting Information with PowerShell · sigma-rule
• F5 BIG-IP iControl Rest API Command Execution - Proxy · sigma-rule
• F5 BIG-IP iControl Rest API Command Execution - Webserver · sigma-rule
• Failed DNS Zone Transfer · sigma-rule
• Failed Logon From Public IP · sigma-rule
• File Access Of Signal Desktop Sensitive Data · sigma-rule
• File Deleted Via Sysinternals SDelete · sigma-rule
• File Download From Browser Process Via Inline URL · sigma-rule
• File Download Using ProtocolHandler.exe · sigma-rule
• File Download Via Bitsadmin · sigma-rule
• File Download via CertOC.EXE · sigma-rule
• File Download Via InstallUtil.EXE · sigma-rule
• File Download Via Nscurl - MacOS · sigma-rule
• File Encoded To Base64 Via Certutil.EXE · sigma-rule
• File Recovery From Backup Via Wbadmin.EXE · sigma-rule
• File Time Attribute Change · sigma-rule
• File Time Attribute Change - Linux · sigma-rule
• Files With System DLL Name In Unsuspected Locations · sigma-rule
• Files With System Process Name In Unsuspected Locations · sigma-rule
• Filter Driver Unloaded Via Fltmc.EXE · sigma-rule
• Findstr Launching .lnk File · sigma-rule
• Firewall Disabled via Netsh.EXE · sigma-rule
• Firewall Rule Deleted Via Netsh.EXE · sigma-rule
• Flush Iptables Ufw Chain · sigma-rule
• Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet · sigma-rule
• Forfiles Command Execution · sigma-rule
• FortiGate - Firewall Address Object Added · sigma-rule
• FortiGate - New Administrator Account Created · sigma-rule
• FortiGate - New Firewall Policy Added · sigma-rule
• FortiGate - New Local User Created · sigma-rule
• FortiGate - New VPN SSL Web Portal Added · sigma-rule
• FortiGate - VPN SSL Settings Modified · sigma-rule
• Function Call From Undocumented COM Interface EditionUpgradeManager · sigma-rule
• GCP Access Policy Deleted · sigma-rule
• GCP Break-glass Container Workload Deployed · sigma-rule
• Get-ADUser Enumeration Using UserAccountControl Flags · sigma-rule
• Github Delete Action Invoked · sigma-rule
• Github Fork Private Repositories Setting Enabled/Cleared · sigma-rule
• Github Outside Collaborator Detected · sigma-rule
• Github Repository/Organization Transferred · sigma-rule
• Github Self-Hosted Runner Execution · sigma-rule
• Github SSH Certificate Configuration Changed · sigma-rule
• Google Cloud Firewall Modified or Deleted · sigma-rule
• Google Cloud Kubernetes Admission Controller · sigma-rule
• Google Cloud Re-identifies Sensitive Information · sigma-rule
• Google Cloud Service Account Disabled or Deleted · sigma-rule
• Google Full Network Traffic Packet Capture · sigma-rule
• Google Workspace Application Access Level Modified · sigma-rule
• Google Workspace Government Attack Warning · sigma-rule
• Google Workspace Granted Domain API Access · sigma-rule
• Google Workspace Out Of Domain Email Forwarding · sigma-rule
• Google Workspace User Granted Admin Privileges · sigma-rule
• GoToAssist Temporary Installation Artefact · sigma-rule
• Gpresult Display Group Policy Information · sigma-rule
• Gpscript Execution · sigma-rule
• Granting Of Permissions To An Account · sigma-rule
• Greedy File Deletion Using Del · sigma-rule
• Group Has Been Deleted Via Groupdel · sigma-rule
• Group Membership Reconnaissance Via Whoami.EXE · sigma-rule
• Group Policy Abuse for Privilege Addition · sigma-rule
• Guest User Invited By Non Approved Inviters · sigma-rule
• Guest Users Invited To Tenant By Non Approved Inviters · sigma-rule
• Gzip Archive Decode Via PowerShell · sigma-rule
• HackTool - Impersonate Execution · sigma-rule
• HackTool - Jlaive In-Memory Assembly Execution · sigma-rule
• HackTool - WinRM Access Via Evil-WinRM · sigma-rule
• Hardware Model Reconnaissance Via Wmic.EXE · sigma-rule
• Harvesting Of Wifi Credentials Via Netsh.EXE · sigma-rule
• Hidden Executable In NTFS Alternate Data Stream · sigma-rule
• Hidden Flag Set On File/Directory Via Chflags - MacOS · sigma-rule
• Hidden Powershell in Link File Pattern · sigma-rule
• Hidden User Creation · sigma-rule
• Hiding Files with Attrib.exe · sigma-rule
• Hiding User Account Via SpecialAccounts Registry Key - CommandLine · sigma-rule
• HTTP Request With Empty User Agent · sigma-rule
• IE Change Domain Zone · sigma-rule
• Ie4uinit Lolbin Use From Invalid Path · sigma-rule
• IIS Native-Code Module Command Line Installation · sigma-rule
• IIS WebServer Access Logs Deleted · sigma-rule
• IIS WebServer Log Deletion via CommandLine Utilities · sigma-rule
• Import LDAP Data Interchange Format File Via Ldifde.EXE · sigma-rule
• Import PowerShell Modules From Suspicious Directories · sigma-rule
• Import PowerShell Modules From Suspicious Directories - ProcCreation · sigma-rule
• Imports Registry Key From a File · sigma-rule
• Increased Failed Authentications Of Any Type · sigma-rule
• Indicator Removal on Host - Clear Mac System Logs · sigma-rule
• Indirect Command Execution From Script File Via Bash.EXE · sigma-rule
• Indirect Command Execution via SFTP ProxyCommand · sigma-rule
• Indirect Inline Command Execution Via Bash.EXE · sigma-rule
• InfDefaultInstall.exe .inf Execution · sigma-rule
• Ingress/Egress Security Group Modification · sigma-rule
• Install New Package Via Winget Local Manifest · sigma-rule
• Installation of TeamViewer Desktop · sigma-rule
• Interactive Bash Suspicious Children · sigma-rule
• Internet Explorer Autorun Keys Modification · sigma-rule
• Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - System · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - Security · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - System · sigma-rule
• ISATAP Router Address Was Set · sigma-rule
• ISO Image Mounted · sigma-rule
• ISO or Image Mount Indicator in Recent Files · sigma-rule
• Java Running with Remote Debugging · sigma-rule
• Kerberoasting Activity - Initial Query · sigma-rule
• Kerberos Network Traffic RC4 Ticket Encryption · sigma-rule
• Kubernetes Admission Controller Modification · sigma-rule
• Kubernetes Events Deleted · sigma-rule
• Kubernetes Potential Enumeration Activity · sigma-rule
• Launch Agent/Daemon Execution Via Launchctl · sigma-rule
• Launch-VsDevShell.PS1 Proxy Execution · sigma-rule
• Linux Base64 Encoded Pipe to Shell · sigma-rule
• Linux Base64 Encoded Shebang In CLI · sigma-rule
• Linux Doas Conf File Creation · sigma-rule
• Linux Logs Clearing Attempts · sigma-rule
• Linux Shell Pipe to Shell · sigma-rule
• LoadBalancer Security Group Modification · sigma-rule
• Loaded Module Enumeration Via Tasklist.EXE · sigma-rule
• Local Network Connection Initiated By Script Interpreter · sigma-rule
• Login to Disabled Account · sigma-rule
• Logon from a Risky IP Address · sigma-rule
• LOLBAS Data Exfiltration by DataSvcUtil.exe · sigma-rule
• Lolbin Runexehelper Use As Proxy · sigma-rule
• Lolbin Unregmp2.exe Use As Proxy · sigma-rule
• LSA PPL Protection Setting Modification via CommandLine · sigma-rule
• LSASS Access From Non System Account · sigma-rule
• MacOS Emond Launch Daemon · sigma-rule
• MacOS Scripting Interpreter AppleScript · sigma-rule
• Malicious Driver Load By Name · sigma-rule
• Malicious PE Execution by Microsoft Visual Studio Debugger · sigma-rule
• Malicious PowerShell Keywords · sigma-rule
• Manipulation of User Computer or Group Security Principals Across AD · sigma-rule
• Masquerading as Linux Crond Process · sigma-rule
• Mesh Agent Service Installation · sigma-rule
• Microsoft 365 - Impossible Travel Activity · sigma-rule
• Microsoft 365 - Potential Ransomware Activity · sigma-rule
• Microsoft 365 - Unusual Volume of File Deletion · sigma-rule
• Microsoft 365 - User Restricted from Sending Email · sigma-rule
• Microsoft Excel Add-In Loaded From Uncommon Location · sigma-rule
• Microsoft Sync Center Suspicious Network Connections · sigma-rule
• Microsoft Teams Sensitive File Access By Uncommon Applications · sigma-rule
• Microsoft VBA For Outlook Addin Loaded Via Outlook · sigma-rule
• MITRE BZAR Indicators for Execution · sigma-rule
• MITRE BZAR Indicators for Persistence · sigma-rule
• MMC Loading Script Engines DLLs · sigma-rule
• Modify Group Policy Settings · sigma-rule
• Modify Group Policy Settings - ScriptBlockLogging · sigma-rule
• Modify System Firewall · sigma-rule
• Modifying Crontab · sigma-rule
• Monitoring For Persistence Via BITS · sigma-rule
• Mount Execution With Hidepid Parameter · sigma-rule
• MSExchange Transport Agent Installation · sigma-rule
• MSExchange Transport Agent Installation - Builtin · sigma-rule
• MSI Installation From Web · sigma-rule
• Msiexec Quiet Installation · sigma-rule
• MsiExec Web Install · sigma-rule
• MSSQL Destructive Query · sigma-rule
• MSSQL Server Failed Logon From External Network · sigma-rule
• Msxsl.EXE Execution · sigma-rule
• Multifactor Authentication Denied · sigma-rule
• Multifactor Authentication Interrupted · sigma-rule
• Netcat The Powershell Version · sigma-rule
• Netsh Allow Group Policy on Microsoft Defender Firewall · sigma-rule
• Network Communication Initiated To Portmap.IO Domain · sigma-rule
• Network Connection Initiated By Regsvr32.EXE · sigma-rule
• Network Connection Initiated To AzureWebsites.NET By Non-Browser Process · sigma-rule
• Network Connection Initiated To BTunnels Domains · sigma-rule
• Network Connection Initiated To Cloudflared Tunnels Domains · sigma-rule
• Network Connection Initiated To DevTunnels Domain · sigma-rule
• Network Connection Initiated To Visual Studio Code Tunnels Domain · sigma-rule
• New BgInfo.EXE Custom DB Path Registry Configuration · sigma-rule
• New BgInfo.EXE Custom VBScript Registry Configuration · sigma-rule
• New BgInfo.EXE Custom WMI Query Registry Configuration · sigma-rule
• New CA Policy by Non-approved Actor · sigma-rule
• New Capture Session Launched Via DXCap.EXE · sigma-rule
• New Custom Shim Database Created · sigma-rule
• New DLL Added to AppCertDlls Registry Key · sigma-rule
• New DLL Added to AppInit_DLLs Registry Key · sigma-rule
• New DLL Registered Via Odbcconf.EXE · sigma-rule
• New DMSA Service Account Created in Specific OUs · sigma-rule
• New Federated Domain Added · sigma-rule
• New Federated Domain Added - Exchange · sigma-rule
• New File Exclusion Added To Time Machine Via Tmutil - MacOS · sigma-rule
• New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE · sigma-rule
• New Firewall Rule Added Via Netsh.EXE · sigma-rule
• New Generic Credentials Added Via Cmdkey.EXE · sigma-rule
• New Kernel Driver Via SC.EXE · sigma-rule
• New Module Module Added To IIS Server · sigma-rule
• New Network Route Added · sigma-rule
• New Network Trace Capture Started Via Netsh.EXE · sigma-rule
• New or Renamed User Account with '$' Character · sigma-rule
• New Outlook Macro Created · sigma-rule
• New PDQDeploy Service - Client Side · sigma-rule
• New PDQDeploy Service - Server Side · sigma-rule
• New Port Forwarding Rule Added Via Netsh.EXE · sigma-rule
• New PortProxy Registry Entry Added · sigma-rule
• New Remote Desktop Connection Initiated Via Mstsc.EXE · sigma-rule
• New Root Certificate Authority Added · sigma-rule
• New Root Certificate Installed Via CertMgr.EXE · sigma-rule
• New Root Certificate Installed Via Certutil.EXE · sigma-rule
• New Root or CA or AuthRoot Certificate to Store · sigma-rule
• New User Created Via Net.EXE · sigma-rule
• Node Process Executions · sigma-rule
• Nohup Execution · sigma-rule
• Notepad++ Updater DNS Query to Uncommon Domains · sigma-rule
• Nslookup PowerShell Download Cradle · sigma-rule
• Ntdsutil Abuse · sigma-rule
• NTLM Brute Force · sigma-rule
• NTLMv1 Logon Between Client and Server · sigma-rule
• Number Of Resource Creation Or Deployment Activities · sigma-rule
• Office Application Initiated Network Connection To Non-Local IP · sigma-rule
• Office Application Startup - Office Test · sigma-rule
• Office Autorun Keys Modification · sigma-rule
• Okta Admin Role Assigned to an User or Group · sigma-rule
• Okta Identity Provider Created · sigma-rule
• Okta MFA Reset or Deactivated · sigma-rule
• Okta User Account Locked Out · sigma-rule
• OpenEDR Spawning Command Shell · sigma-rule
• OpenSSH Server Listening On Socket · sigma-rule
• Osacompile Execution By Potentially Suspicious Applet/Osascript · sigma-rule
• Outbound Network Connection To Public IP Via Winlogon · sigma-rule
• Outlook Security Settings Updated - Registry · sigma-rule
• PAExec Service Installation · sigma-rule
• Pass the Hash Activity 2 · sigma-rule
• Password Policy Enumerated · sigma-rule
• Password Protected ZIP File Opened · sigma-rule
• Password Provided In Command Line Of Net.EXE · sigma-rule
• Password Reset By User Account · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Path To Screensaver Binary Modified · sigma-rule
• Path Traversal Exploitation Attempts · sigma-rule
• Payload Decoded and Decrypted via Built-in Utilities · sigma-rule
• PDQ Deploy Remote Adminstartion Tool Execution · sigma-rule
• Periodic Backup For System Registry Hives Enabled · sigma-rule
• Perl Inline Command Execution · sigma-rule
• Permission Check Via Accesschk.EXE · sigma-rule
• Permission Misconfiguration Reconnaissance Via Findstr.EXE · sigma-rule
• Persistence Via New SIP Provider · sigma-rule
• Persistence Via Sudoers.d Files · sigma-rule
• Php Inline Command Execution · sigma-rule
• PktMon.EXE Execution · sigma-rule
• Pnscan Binary Data Transmission Activity · sigma-rule
• Port Forwarding Activity Via SSH.EXE · sigma-rule
• Portable Gpg.EXE Execution · sigma-rule
• Possible DC Shadow Attack · sigma-rule
• Potential Abuse of Linux Magic System Request Key · sigma-rule
• Potential Access Token Abuse · sigma-rule
• Potential Active Directory Reconnaissance/Enumeration Via LDAP · sigma-rule
• Potential AD User Enumeration From Non-Machine Account · sigma-rule
• Potential Amazon SSM Agent Hijacking · sigma-rule
• Potential AMSI Bypass Script Using NULL Bits · sigma-rule
• Potential AMSI Bypass Using NULL Bits · sigma-rule
• Potential Antivirus Software DLL Sideloading · sigma-rule
• Potential Application Whitelisting Bypass via Dnx.EXE · sigma-rule
• Potential Arbitrary Command Execution Via FTP.EXE · sigma-rule
• Potential Arbitrary DLL Load Using Winword · sigma-rule
• Potential Arbitrary File Download Via Cmdl32.EXE · sigma-rule
• Potential AVKkid.DLL Sideloading · sigma-rule
• Potential Base64 Encoded User-Agent · sigma-rule
• Potential Binary Impersonating Sysinternals Tools · sigma-rule
• Potential Binary Proxy Execution Via Cdb.EXE · sigma-rule
• Potential Binary Proxy Execution Via VSDiagnostics.EXE · sigma-rule
• Potential Browser Data Stealing · sigma-rule
• Potential CCleanerDU.DLL Sideloading · sigma-rule
• Potential CCleanerReactivator.DLL Sideloading · sigma-rule
• Potential Chrome Frame Helper DLL Sideloading · sigma-rule
• Potential COM Object Hijacking Via TreatAs Subkey - Registry · sigma-rule
• Potential COM Objects Download Cradles Usage - Process Creation · sigma-rule
• Potential COM Objects Download Cradles Usage - PS Script · sigma-rule
• Potential Command Line Path Traversal Evasion Attempt · sigma-rule
• Potential Commandline Obfuscation Using Escape Characters · sigma-rule
• Potential Configuration And Service Reconnaissance Via Reg.EXE · sigma-rule
• Potential Credential Dumping Activity Via LSASS · sigma-rule
• Potential Credential Dumping Attempt Using New NetworkProvider - REG · sigma-rule
• Potential Defense Evasion Via Binary Rename · sigma-rule
• Potential Direct Syscall of NtOpenProcess · sigma-rule
• Potential Discovery Activity Using Find - Linux · sigma-rule
• Potential Discovery Activity Using Find - MacOS · sigma-rule
• Potential DLL File Download Via PowerShell Invoke-WebRequest · sigma-rule
• Potential DLL Injection Or Execution Using Tracker.exe · sigma-rule
• Potential DLL Sideloading Of DBGCORE.DLL · sigma-rule
• Potential DLL Sideloading Of DBGHELP.DLL · sigma-rule
• Potential DLL Sideloading Of DbgModel.DLL · sigma-rule
• Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE · sigma-rule
• Potential DLL Sideloading Of MpSvc.DLL · sigma-rule
• Potential DLL Sideloading Of MsCorSvc.DLL · sigma-rule
• Potential DLL Sideloading Using Coregen.exe · sigma-rule
• Potential DLL Sideloading Via ClassicExplorer32.dll · sigma-rule
• Potential DLL Sideloading Via DeviceEnroller.EXE · sigma-rule
• Potential DLL Sideloading Via JsSchHlp · sigma-rule
• Potential Dosfuscation Activity · sigma-rule
• Potential Download/Upload Activity Using Type Command · sigma-rule
• Potential Dropper Script Execution Via WScript/CScript/MSHTA · sigma-rule
• Potential Fake Instance Of Hxtsr.EXE Executed · sigma-rule
• Potential File Download Via MS-AppInstaller Protocol Handler · sigma-rule
• Potential Goopdate.DLL Sideloading · sigma-rule
• Potential Hello-World Scraper Botnet Activity · sigma-rule
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream · sigma-rule
• Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI · sigma-rule
• Potential Homoglyph Attack Using Lookalike Characters · sigma-rule
• Potential Homoglyph Attack Using Lookalike Characters in Filename · sigma-rule
• Potential In-Memory Download And Compile Of Payloads · sigma-rule
• Potential In-Memory Execution Using Reflection.Assembly · sigma-rule
• Potential Initial Access via DLL Search Order Hijacking · sigma-rule
• Potential Keylogger Activity · sigma-rule
• Potential Lateral Movement via Windows Remote Shell · sigma-rule
• Potential Libvlc.DLL Sideloading · sigma-rule
• Potential Linux Amazon SSM Agent Hijacking · sigma-rule
• Potential Linux Process Code Injection Via DD Utility · sigma-rule
• Potential Mfdetours.DLL Sideloading · sigma-rule
• Potential Mftrace.EXE Abuse · sigma-rule
• Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution · sigma-rule
• Potential Network Sniffing Activity Using Network Tools · sigma-rule
• Potential Obfuscated Ordinal Call Via Rundll32 · sigma-rule
• Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock · sigma-rule
• Potential Password Spraying Attempt Using Dsacls.EXE · sigma-rule
• Potential PendingFileRenameOperations Tampering · sigma-rule
• Potential Persistence Attempt Via Existing Service Tampering · sigma-rule
• Potential Persistence Attempt Via Run Keys Using Reg.EXE · sigma-rule
• Potential Persistence Using DebugPath · sigma-rule
• Potential Persistence Via AppCompat RegisterAppRestart Layer · sigma-rule
• Potential Persistence Via Custom Protocol Handler · sigma-rule
• Potential Persistence Via Event Viewer Events.asp · sigma-rule
• Potential Persistence Via Logon Scripts - Registry · sigma-rule
• Potential Persistence Via Microsoft Compatibility Appraiser · sigma-rule
• Potential Persistence Via Netsh Helper DLL · sigma-rule
• Potential Persistence Via Netsh Helper DLL - Registry · sigma-rule
• Potential Persistence Via PowerShell User Profile Using Add-Content · sigma-rule
• Potential Persistence Via Scrobj.dll COM Hijacking · sigma-rule
• Potential Persistence Via Shim Database Modification · sigma-rule
• Potential Persistence Via Visual Studio Tools for Office · sigma-rule
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Potential PetitPotam Attack Via EFS RPC Calls · sigma-rule
• Potential PowerShell Console History Access Attempt via History File · sigma-rule
• Potential PowerShell Downgrade Attack · sigma-rule
• Potential Privileged System Service Operation - SeLoadDriverPrivilege · sigma-rule
• Potential Process Execution Proxy Via CL_Invocation.ps1 · sigma-rule
• Potential Process Hollowing Activity · sigma-rule
• Potential Process Reconnaissance via Wmic.EXE · sigma-rule
• Potential Product Class Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Product Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Provlaunch.EXE Binary Proxy Execution Abuse · sigma-rule
• Potential Python DLL SideLoading · sigma-rule
• Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE · sigma-rule
• Potential Recon Activity Via Nltest.EXE · sigma-rule
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
• Potential ReflectDebugger Content Execution Via WerFault.EXE · sigma-rule
• Potential Register_App.Vbs LOLScript Abuse · sigma-rule
• Potential Registry Persistence Attempt Via DbgManagedDebugger · sigma-rule
• Potential Regsvr32 Commandline Flag Anomaly · sigma-rule
• Potential Remote Command Execution In Pod Container · sigma-rule
• Potential Remote Desktop Connection to Non-Domain Host · sigma-rule
• Potential Remote Desktop Tunneling · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Default Location · sigma-rule
• Potential RoboForm.DLL Sideloading · sigma-rule
• Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 · sigma-rule
• Potential Secure Deletion with SDelete · sigma-rule
• Potential ShellDispatch.DLL Sideloading · sigma-rule
• Potential Shim Database Persistence via Sdbinst.EXE · sigma-rule
• Potential Sidecar Injection Into Running Deployment · sigma-rule
• Potential SolidPDFCreator.DLL Sideloading · sigma-rule
• Potential SPN Enumeration Via Setspn.EXE · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Potential Suspicious Browser Launch From Document Reader Process · sigma-rule
• Potential Suspicious Change To Sensitive/Critical Files · sigma-rule
• Potential Suspicious PowerShell Keywords · sigma-rule
• Potential Suspicious Registry File Imported Via Reg.EXE · sigma-rule
• Potential UAC Bypass Via Sdclt.EXE · sigma-rule
• Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock · sigma-rule
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Vivaldi_elf.DLL Sideloading · sigma-rule
• Potential Wazuh Security Platform DLL Sideloading · sigma-rule
• Potential Webshell Creation On Static Website · sigma-rule
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell · sigma-rule
• Potential WWlib.DLL Sideloading · sigma-rule
• Potential Xterm Reverse Shell · sigma-rule
• Potentially Over Permissive Permissions Granted Using Dsacls.EXE · sigma-rule
• Potentially Suspicious AccessMask Requested From LSASS · sigma-rule
• Potentially Suspicious Cabinet File Expansion · sigma-rule
• Potentially Suspicious Child Process Of DiskShadow.EXE · sigma-rule
• Potentially Suspicious Child Process of KeyScrambler.exe · sigma-rule
• Potentially Suspicious Child Process Of VsCode · sigma-rule
• Potentially Suspicious Child Process Of WinRAR.EXE · sigma-rule
• Potentially Suspicious CMD Shell Output Redirect · sigma-rule
• Potentially Suspicious Command Targeting Teams Sensitive Files · sigma-rule
• Potentially Suspicious Desktop Background Change Using Reg.EXE · sigma-rule
• Potentially Suspicious Desktop Background Change Via Registry · sigma-rule
• Potentially Suspicious EventLog Recon Activity Using Log Query Utilities · sigma-rule
• Potentially Suspicious Execution From Tmp Folder · sigma-rule
• Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location · sigma-rule
• Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension · sigma-rule
• Potentially Suspicious File Creation by OpenEDR's ITSMService · sigma-rule
• Potentially Suspicious GrantedAccess Flags On LSASS · sigma-rule
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary · sigma-rule
• Potentially Suspicious JWT Token Search Via CLI · sigma-rule
• Potentially Suspicious NTFS Symlink Behavior Modification · sigma-rule
• Potentially Suspicious Ping/Copy Command Combination · sigma-rule
• Potentially Suspicious Powershell Script Execution From Temp Folder · sigma-rule
• Potentially Suspicious Regsvr32 HTTP/FTP Pattern · sigma-rule
• Potentially Suspicious Rundll32 Activity · sigma-rule
• Potentially Suspicious Rundll32.EXE Execution of UDL File · sigma-rule
• Potentially Suspicious Self Extraction Directive File Created · sigma-rule
• Potentially Suspicious Usage Of Qemu · sigma-rule
• Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load · sigma-rule
• Potentially Suspicious WebDAV LNK Execution · sigma-rule
• Potentially Suspicious Wuauclt Network Connection · sigma-rule
• PowerShell Console History Logs Deleted · sigma-rule
• PowerShell Core DLL Loaded By Non PowerShell Process · sigma-rule
• PowerShell Create Local User · sigma-rule
• Powershell Create Scheduled Task · sigma-rule
• Powershell Defender Exclusion · sigma-rule
• PowerShell Deleted Mounted Share · sigma-rule
• Powershell Detect Virtualization Environment · sigma-rule
• Powershell Directory Enumeration · sigma-rule
• PowerShell Downgrade Attack - PowerShell · sigma-rule
• PowerShell Download Pattern · sigma-rule
• Powershell Execute Batch Script · sigma-rule
• Powershell Executed From Headless ConHost Process · sigma-rule
• PowerShell Get Clipboard · sigma-rule
• PowerShell Get-Clipboard Cmdlet Via CLI · sigma-rule
• PowerShell ICMP Exfiltration · sigma-rule
• Powershell Inline Execution From A File · sigma-rule
• Powershell Keylogging · sigma-rule
• Powershell Local Email Collection · sigma-rule
• Powershell LocalAccount Manipulation · sigma-rule
• PowerShell MSI Install via WindowsInstaller COM From Remote Location · sigma-rule
• Powershell MsXml COM Object · sigma-rule
• PowerShell Profile Modification · sigma-rule
• PowerShell Remote Session Creation · sigma-rule
• PowerShell Script Run in AppData · sigma-rule
• PowerShell Script With File Hostname Resolving Capabilities · sigma-rule
• Powershell Sensitive File Discovery · sigma-rule
• Powershell Store File In Alternate Data Stream · sigma-rule
• Powershell Timestomp · sigma-rule
• Powershell WMI Persistence · sigma-rule
• PowerShell WMI Win32_Product Install MSI · sigma-rule
• Powershell XML Execute Command · sigma-rule
• Print History File Contents · sigma-rule
• Private Keys Reconnaissance Via CommandLine Tools · sigma-rule
• Privileged Account Creation · sigma-rule
• Procdump Execution · sigma-rule
• Process Creation Attempt via Wmic.EXE · sigma-rule
• Process Creation Using Sysnative Folder · sigma-rule
• Process Memory Dump Via Dotnet-Dump · sigma-rule
• Process Monitor Driver Creation By Non-Sysinternals Binary · sigma-rule
• Process Proxy Execution Via Squirrel.EXE · sigma-rule
• Processes Accessing the Microphone and Webcam · sigma-rule
• Program Executed Using Proxy/Local Command Via SSH.EXE · sigma-rule
• Program Executions in Suspicious Folders · sigma-rule
• Proxy Execution via Vshadow · sigma-rule
• Psexec Execution · sigma-rule
• PsExec Service Installation · sigma-rule
• PsExec Tool Execution From Suspicious Locations - PipeName · sigma-rule
• PST Export Alert Using eDiscovery Alert · sigma-rule
• PST Export Alert Using New-ComplianceSearchAction · sigma-rule
• PUA - AdFind.EXE Execution · sigma-rule
• PUA - Advanced IP Scanner Execution · sigma-rule
• PUA - Advanced IP/Port Scanner Update Check · sigma-rule
• PUA - Advanced Port Scanner Execution · sigma-rule
• PUA - AdvancedRun Execution · sigma-rule
• PUA - AWS TruffleHog Execution · sigma-rule
• PUA - CSExec Default Named Pipe · sigma-rule
• PUA - Mouse Lock Execution · sigma-rule
• PUA - NimScan Execution · sigma-rule
• PUA - NirCmd Execution · sigma-rule
• PUA - Nmap/Zenmap Execution · sigma-rule
• PUA - PAExec Default Named Pipe · sigma-rule
• PUA - PingCastle Execution · sigma-rule
• PUA - Potential PE Metadata Tamper Using Rcedit · sigma-rule
• PUA - Process Hacker Execution · sigma-rule
• PUA - Radmin Viewer Utility Execution · sigma-rule
• PUA - RemCom Default Named Pipe · sigma-rule
• PUA - SoftPerfect Netscan Execution · sigma-rule
• PUA - Sysinternals Tools Execution - Registry · sigma-rule
• PUA - System Informer Driver Load · sigma-rule
• PUA - System Informer Execution · sigma-rule
• PUA - TruffleHog Execution · sigma-rule
• PUA - TruffleHog Execution - Linux · sigma-rule
• PUA - WebBrowserPassView Execution · sigma-rule
• Pubprn.vbs Proxy Execution · sigma-rule
• Python Initiated Connection · sigma-rule
• Python Inline Command Execution · sigma-rule
• Python Spawning Pretty TTY Via PTY Module · sigma-rule
• Python SQL Exceptions · sigma-rule
• Python WebServer Execution - Linux · sigma-rule
• Rare Subscription-level Operations In Azure · sigma-rule
• Rclone Activity via Proxy · sigma-rule
• Rclone Config File Creation · sigma-rule
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · sigma-rule
• RDP Sensitive Settings Changed to Zero · sigma-rule
• RDS Database Security Group Modification · sigma-rule
• Read Contents From Stdin Via Cmd.EXE · sigma-rule
• Recon Command Output Piped To Findstr.EXE · sigma-rule
• Recon Information for Export with Command Prompt · sigma-rule
• Recon Information for Export with PowerShell · sigma-rule
• RegAsm.EXE Initiating Network Connection To Public IP · sigma-rule
• REGISTER_APP.VBS Proxy Execution · sigma-rule
• Registry Enumeration via WMI Stdregprov · sigma-rule
• Registry Explorer Policy Modification · sigma-rule
• Registry Hide Function from User · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Registry Modification Attempt Via VBScript · sigma-rule
• Registry Modification Attempt Via VBScript - PowerShell · sigma-rule
• Registry Modification of MS-settings Protocol Handler · sigma-rule
• Registry Modification to Hidden File Extension · sigma-rule
• Registry Tampering by Potentially Suspicious Processes · sigma-rule
• Registry-Free Process Scope COR_PROFILER · sigma-rule
• Regsvr32 DLL Execution With Uncommon Extension · sigma-rule
• Regsvr32 Execution From Potential Suspicious Location · sigma-rule
• RemCom Service File Creation · sigma-rule
• RemCom Service Installation · sigma-rule
• Remote Access Tool - AnyDesk Execution · sigma-rule
• Remote Access Tool - AnyDesk Incoming Connection · sigma-rule
• Remote Access Tool - AnyDesk Piped Password Via CLI · sigma-rule
• Remote Access Tool - GoToAssist Execution · sigma-rule
• Remote Access Tool - LogMeIn Execution · sigma-rule
• Remote Access Tool - MeshAgent Command Execution via MeshCentral · sigma-rule
• Remote Access Tool - NetSupport Execution · sigma-rule
• Remote Access Tool - Potential MeshAgent Execution - MacOS · sigma-rule
• Remote Access Tool - Potential MeshAgent Execution - Windows · sigma-rule
• Remote Access Tool - ScreenConnect Execution · sigma-rule
• Remote Access Tool - ScreenConnect Installation Execution · sigma-rule
• Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution · sigma-rule
• Remote Access Tool - Simple Help Execution · sigma-rule
• Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server · sigma-rule
• Remote Access Tool - UltraViewer Execution · sigma-rule
• Remote Access Tool Services Have Been Installed - Security · sigma-rule
• Remote Access Tool Services Have Been Installed - System · sigma-rule
• Remote Code Execute via Winrm.vbs · sigma-rule
• Remote DLL Load Via Rundll32.EXE · sigma-rule
• Remote File Download Via Desktopimgdownldr Utility · sigma-rule
• Remote File Download Via Findstr.EXE · sigma-rule
• Remote PowerShell Session Host Process (WinRM) · sigma-rule
• Remote Service Activity via SVCCTL Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe - Zeek · sigma-rule
• Remote Thread Creation By Uncommon Source Image · sigma-rule
• Remote Thread Creation In Uncommon Target Image · sigma-rule
• Remote Thread Creation Via PowerShell In Uncommon Target · sigma-rule
• Removal Of Index Value to Hide Schedule Task - Registry · sigma-rule
• Removal of Potential COM Hijacking Registry Keys · sigma-rule
• Removal Of SD Value to Hide Schedule Task - Registry · sigma-rule
• Remove Account From Domain Admin Group · sigma-rule
• Remove Immutable File Attribute · sigma-rule
• Remove Immutable File Attribute - Auditd · sigma-rule
• Renamed BOINC Client Execution · sigma-rule
• Renamed CURL.EXE Execution · sigma-rule
• Renamed FTP.EXE Execution · sigma-rule
• Replace.exe Usage · sigma-rule
• Response File Execution Via Odbcconf.EXE · sigma-rule
• Root Account Enable Via Dsenableroot · sigma-rule
• Root Certificate Installed - PowerShell · sigma-rule
• Ruby Inline Command Execution · sigma-rule
• Ruby on Rails Framework Exceptions · sigma-rule
• Run Once Task Configuration in Registry · sigma-rule
• Rundll32 Execution With Uncommon DLL Extension · sigma-rule
• Rundll32 InstallScreenSaver Execution · sigma-rule
• Rundll32 Internet Connection · sigma-rule
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · sigma-rule
• Scheduled Cron Task/Job - Linux · sigma-rule
• Scheduled Cron Task/Job - MacOs · sigma-rule
• Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
• Scheduled Task Executed From A Suspicious Location · sigma-rule
• Scheduled Task Executed Uncommon LOLBIN · sigma-rule
• Scheduled Task Executing Payload from Registry · sigma-rule
• SCM Database Handle Failure · sigma-rule
• SCM Database Privileged Operation · sigma-rule
• SCR File Write Event · sigma-rule
• Screen Capture Activity Via Psr.EXE · sigma-rule
• ScreenConnect Temporary Installation Artefact · sigma-rule
• ScreenSaver Registry Key Set · sigma-rule
• Scripted Diagnostics Turn Off Check Enabled - Registry · sigma-rule
• Scripting/CommandLine Process Spawned Regsvr32 · sigma-rule
• Sdclt Child Processes · sigma-rule
• Security Software Discovery - MacOs · sigma-rule
• Security Software Discovery Via Powershell Script · sigma-rule
• Security Tools Keyword Lookup Via Findstr.EXE · sigma-rule
• Self Extraction Directive File Created In Potentially Suspicious Location · sigma-rule
• Service Installation in Suspicious Folder · sigma-rule
• Service Reconnaissance Via Wmic.EXE · sigma-rule
• Service Registry Permissions Weakness Check · sigma-rule
• Service Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Service Started/Stopped Via Wmic.EXE · sigma-rule
• Service Startup Type Change Via Wmic.EXE · sigma-rule
• Service StartupType Change Via PowerShell Set-Service · sigma-rule
• Service StartupType Change Via Sc.EXE · sigma-rule
• ServiceDll Hijack · sigma-rule
• SES Identity Has Been Deleted · sigma-rule
• Session Manager Autorun Keys Modification · sigma-rule
• Setup16.EXE Execution With Custom .Lst File · sigma-rule
• Shadow Copies Creation Using Operating Systems Utilities · sigma-rule
• Shell Invocation via Apt - Linux · sigma-rule
• SMB Spoolss Name Piped Usage · sigma-rule
• Source Code Enumeration Detection by Keyword · sigma-rule
• Spring Framework Exceptions · sigma-rule
• SQL Client Tools PowerShell Session Detection · sigma-rule
• Startup Folder File Write · sigma-rule
• Startup/Logon Script Added to Group Policy Object · sigma-rule
• Successful Authentications From Countries You Do Not Operate Out Of · sigma-rule
• Successful IIS Shortname Fuzzing Scan · sigma-rule
• Suspicious Access to Sensitive File Extensions · sigma-rule
• Suspicious Appended Extension · sigma-rule
• Suspicious Base64 Encoded User-Agent · sigma-rule
• Suspicious Browser Child Process - MacOS · sigma-rule
• Suspicious Cabinet File Execution Via Msdt.EXE · sigma-rule
• Suspicious CodePage Switch Via CHCP · sigma-rule
• Suspicious Commands Linux · sigma-rule
• Suspicious Computer Machine Password by PowerShell · sigma-rule
• Suspicious Copy From or To System Directory · sigma-rule
• Suspicious Csi.exe Usage · sigma-rule
• Suspicious Curl Change User Agents - Linux · sigma-rule
• Suspicious Curl File Upload - Linux · sigma-rule
• Suspicious Diantz Alternate Data Stream Execution · sigma-rule
• Suspicious Diantz Download and Compress Into a CAB File · sigma-rule
• Suspicious DNS Query for IP Lookup Service APIs · sigma-rule
• Suspicious DNS Query with B64 Encoded String · sigma-rule
• Suspicious DNS Z Flag Bit Set · sigma-rule
• Suspicious Download Via Certutil.EXE · sigma-rule
• Suspicious Driver Install by pnputil.exe · sigma-rule
• Suspicious Email Delivered In Microsoft 365 · sigma-rule
• Suspicious Eventlog Clear · sigma-rule
• Suspicious Execution of Powershell with Base64 · sigma-rule
• Suspicious Execution of Shutdown · sigma-rule
• Suspicious Execution of Shutdown to Log Out · sigma-rule
• Suspicious Execution via macOS Script Editor · sigma-rule
• Suspicious Extrac32 Alternate Data Stream Execution · sigma-rule
• Suspicious Extrac32 Execution · sigma-rule
• Suspicious File Characteristics Due to Missing Fields · sigma-rule
• Suspicious File Created In PerfLogs · sigma-rule
• Suspicious File Drop by Exchange · sigma-rule
• Suspicious File Write to Webapps Root Directory · sigma-rule
• Suspicious Files in Default GPO Folder · sigma-rule
• Suspicious FromBase64String Usage On Gzip Archive - Process Creation · sigma-rule
• Suspicious FromBase64String Usage On Gzip Archive - Ps Script · sigma-rule
• Suspicious Get-ADReplAccount · sigma-rule
• Suspicious GetTypeFromCLSID ShellExecute · sigma-rule
• Suspicious Git Clone · sigma-rule
• Suspicious Git Clone - Linux · sigma-rule
• Suspicious Group And Account Reconnaissance Activity Using Net.EXE · sigma-rule
• Suspicious History File Operations · sigma-rule
• Suspicious History File Operations - Linux · sigma-rule
• Suspicious Hyper-V Cmdlets · sigma-rule
• Suspicious Installer Package Child Process · sigma-rule
• Suspicious Invoke-Item From Mount-DiskImage · sigma-rule
• Suspicious Invoke-WebRequest Execution With DirectIP · sigma-rule
• Suspicious IO.FileStream · sigma-rule
• Suspicious Kerberos RC4 Ticket Encryption · sigma-rule
• Suspicious Keyboard Layout Load · sigma-rule
• Suspicious LNK Double Extension File Created · sigma-rule
• Suspicious Login Activity Classified By Google · sigma-rule
• Suspicious MsiExec Embedding Parent · sigma-rule
• Suspicious Msiexec Execute Arbitrary DLL · sigma-rule
• Suspicious Msiexec Quiet Install From Remote Location · sigma-rule
• Suspicious Network Connection to IP Lookup Service APIs · sigma-rule
• Suspicious New-PSDrive to Admin Share · sigma-rule
• Suspicious Non PowerShell WSMAN COM Provider · sigma-rule
• Suspicious Non-Browser Network Communication With Google API · sigma-rule
• Suspicious Non-Browser Network Communication With Telegram API · sigma-rule
• Suspicious OpenSSH Daemon Error · sigma-rule
• Suspicious Outbound SMTP Connections · sigma-rule
• Suspicious Package Installed - Linux · sigma-rule
• Suspicious PowerShell Download - PoshModule · sigma-rule
• Suspicious PowerShell Download - Powershell Script · sigma-rule
• Suspicious PowerShell In Registry Run Keys · sigma-rule
• Suspicious PowerShell Invocation From Script Engines · sigma-rule
• Suspicious PowerShell WindowStyle Option · sigma-rule
• Suspicious Process Start Locations · sigma-rule
• Suspicious PROCEXP152.sys File Created In TMP · sigma-rule
• Suspicious RASdial Activity · sigma-rule
• Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet · sigma-rule
• Suspicious Recursive Takeown · sigma-rule
• Suspicious Rejected SMB Guest Logon From IP · sigma-rule
• Suspicious Remote Logon with Explicit Credentials · sigma-rule
• Suspicious Rundll32 Setupapi.dll Activity · sigma-rule
• Suspicious Runscripthelper.exe · sigma-rule
• Suspicious Scan Loop Network · sigma-rule
• Suspicious Scheduled Task Creation via Masqueraded XML File · sigma-rule
• Suspicious Scheduled Task Name As GUID · sigma-rule
• Suspicious Schtasks Schedule Type With High Privileges · sigma-rule
• Suspicious ScreenSave Change by Reg.exe · sigma-rule
• Suspicious Screensaver Binary File Creation · sigma-rule
• Suspicious Service Installed · sigma-rule
• Suspicious Shell Open Command Registry Modification · sigma-rule
• Suspicious SQL Query · sigma-rule
• Suspicious Start-Process PassThru · sigma-rule
• Suspicious SysAidServer Child · sigma-rule
• Suspicious SYSVOL Domain Group Policy Access · sigma-rule
• Suspicious TCP Tunnel Via PowerShell Script · sigma-rule
• Suspicious Unblock-File · sigma-rule
• Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) · sigma-rule
• Suspicious Usage of For Loop with Recursive Directory Search in CMD · sigma-rule
• Suspicious Use of PsLogList · sigma-rule
• Suspicious User-Agents Related To Recon Tools · sigma-rule
• Suspicious Userinit Child Process · sigma-rule
• Suspicious VBoxDrvInst.exe Parameters · sigma-rule
• Suspicious VSFTPD Error Messages · sigma-rule
• Suspicious Vsls-Agent Command With AgentExtensionPath Load · sigma-rule
• Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE · sigma-rule
• Suspicious WSMAN Provider Image Loads · sigma-rule
• Suspicious X509Enrollment - Process Creation · sigma-rule
• Suspicious X509Enrollment - Ps Script · sigma-rule
• Suspicious XOR Encoded PowerShell Command · sigma-rule
• Suspicious ZipExec Execution · sigma-rule
• SyncAppvPublishingServer Bypass Powershell Restriction - PS Module · sigma-rule
• SyncAppvPublishingServer Execute Arbitrary PowerShell Code · sigma-rule
• SyncAppvPublishingServer Execution to Bypass Powershell Restriction · sigma-rule
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code · sigma-rule
• Sysinternals PsService Execution · sigma-rule
• Sysinternals PsSuspend Execution · sigma-rule
• Sysmon Configuration Update · sigma-rule
• Sysprep on AppData Folder · sigma-rule
• System Disk And Volume Reconnaissance Via Wmic.EXE · sigma-rule
• System Information Discovery Using Ioreg · sigma-rule
• System Information Discovery Using sw_vers · sigma-rule
• System Information Discovery Using System_Profiler · sigma-rule
• System Information Discovery Via Sysctl - MacOS · sigma-rule
• System Integrity Protection (SIP) Disabled · sigma-rule
• System Language Discovery via Reg.Exe · sigma-rule
• System Scripts Autorun Keys Modification · sigma-rule
• Systemd Service Creation · sigma-rule
• TacticalRMM Service Installation · sigma-rule
• Tap Driver Installation · sigma-rule
• Tap Installer Execution · sigma-rule
• TeamViewer Domain Query By Non-TeamViewer Application · sigma-rule
• TeamViewer Remote Session · sigma-rule
• Telegram API Access · sigma-rule
• Telegram Bot API Request · sigma-rule
• Testing Usage of Uncommonly Used Port · sigma-rule
• Third Party Software DLL Sideloading · sigma-rule
• Time Machine Backup Deletion Attempt Via Tmutil - MacOS · sigma-rule
• Time Machine Backup Disabled Via Tmutil - MacOS · sigma-rule
• Tomcat WebServer Logs Deleted · sigma-rule
• Touch Suspicious Service File · sigma-rule
• Transferring Files with Credential Data via Network Shares · sigma-rule
• Transferring Files with Credential Data via Network Shares - Zeek · sigma-rule
• Troubleshooting Pack Cmdlet Execution · sigma-rule
• UAC Bypass via Windows Firewall Snap-In Hijack · sigma-rule
• UAC Disabled · sigma-rule
• UAC Notification Disabled · sigma-rule
• UAC Secure Desktop Prompt Disabled · sigma-rule
• UFW Disable Attempt · sigma-rule
• Uncommon Assistive Technology Applications Execution Via AtBroker.EXE · sigma-rule
• Uncommon AddinUtil.EXE CommandLine Execution · sigma-rule
• Uncommon Child Process Of AddinUtil.EXE · sigma-rule
• Uncommon Child Process Of Appvlp.EXE · sigma-rule
• Uncommon Child Process Of BgInfo.EXE · sigma-rule
• Uncommon Child Process Of Conhost.EXE · sigma-rule
• Uncommon Child Process Of Defaultpack.EXE · sigma-rule
• Uncommon Child Process Spawned By Odbcconf.EXE · sigma-rule
• Uncommon Connection to Active Directory Web Services · sigma-rule
• Uncommon Extension Shim Database Installation Via Sdbinst.EXE · sigma-rule
• Uncommon Link.EXE Parent Process · sigma-rule
• Uncommon New Firewall Rule Added In Windows Firewall Exception List · sigma-rule
• Uncommon Outbound Kerberos Connection · sigma-rule
• Uncommon Outbound Kerberos Connection - Security · sigma-rule
• Uncommon Service Installation Image Path · sigma-rule
• Uncommon Sigverif.EXE Child Process · sigma-rule
• Uncommon Svchost Parent Process · sigma-rule
• Uncommon System Information Discovery Via Wmic.EXE · sigma-rule
• Unix Shell Configuration Modification · sigma-rule
• Unsigned .node File Loaded · sigma-rule
• Unsigned DLL Loaded by Windows Utility · sigma-rule
• Unsigned Image Loaded Into LSASS Process · sigma-rule
• Unsigned Module Loaded by ClickOnce Application · sigma-rule
• Unsigned or Unencrypted SMB Connection to Share Established · sigma-rule
• Unusual File Download From File Sharing Websites - File Stream · sigma-rule
• Unusual Parent Process For Cmd.EXE · sigma-rule
• Usage Of Web Request Commands And Cmdlets · sigma-rule
• Usage Of Web Request Commands And Cmdlets - ScriptBlock · sigma-rule
• Use Icacls to Hide File to Everyone · sigma-rule
• Use NTFS Short Name in Command Line · sigma-rule
• Use NTFS Short Name in Image · sigma-rule
• Use of FSharp Interpreters · sigma-rule
• Use of OpenConsole · sigma-rule
• Use of Pcalua For Execution · sigma-rule
• Use of Remote.exe · sigma-rule
• Use of Scriptrunner.exe · sigma-rule
• Use Of The SFTP.EXE Binary As A LOLBIN · sigma-rule
• Use of TTDInject.exe · sigma-rule
• Use of UltraVNC Remote Access Software · sigma-rule
• Use of VisualUiaVerifyNative.exe · sigma-rule
• Use of VSIISExeLauncher.exe · sigma-rule
• Use of Wfc.exe · sigma-rule
• Use Short Name Path in Image · sigma-rule
• User Access Blocked by Azure Conditional Access · sigma-rule
• User Added To Admin Group Via Dscl · sigma-rule
• User Added To Admin Group Via DseditGroup · sigma-rule
• User Added To Admin Group Via Sysadminctl · sigma-rule
• User Added to an Administrator's Azure AD Role · sigma-rule
• User Added To Group With CA Policy Modification Access · sigma-rule
• User Added to Local Administrator Group · sigma-rule
• User Added to Local Administrators Group · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet · sigma-rule
• User Discovery And Export Via Get-ADUser Cmdlet - PowerShell · sigma-rule
• User Has Been Deleted Via Userdel · sigma-rule
• User Removed From Group With CA Policy Modification Access · sigma-rule
• User State Changed From Guest To Member · sigma-rule
• Users Authenticating To Other Azure AD Tenants · sigma-rule
• UtilityFunctions.ps1 Proxy Dll · sigma-rule
• Veeam Backup Database Suspicious Query · sigma-rule
• Verclsid.exe Runs COM Object · sigma-rule
• VHD Image Download Via Browser · sigma-rule
• Visual Studio Code Tunnel Execution · sigma-rule
• Visual Studio Code Tunnel Service Installation · sigma-rule
• Visual Studio Code Tunnel Shell Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Renamed Execution · sigma-rule
• VMGuestLib DLL Sideload · sigma-rule
• VMMap Signed Dbghelp.DLL Potential Sideloading · sigma-rule
• VsCode Powershell Profile Modification · sigma-rule
• WebDav Client Execution Via Rundll32.EXE · sigma-rule
• WFP Filter Added via Registry · sigma-rule
• Wget Creating Files in Tmp Directory · sigma-rule
• Whoami.EXE Execution Anomaly · sigma-rule
• Whoami.EXE Execution With Output Option · sigma-rule
• Windows Admin Share Mount Via Net.EXE · sigma-rule
• Windows AppX Deployment Full Trust Package Installation · sigma-rule
• Windows AppX Deployment Unsigned Package Installation · sigma-rule
• Windows Backup Deleted Via Wbadmin.EXE · sigma-rule
• Windows Binary Executed From WSL · sigma-rule
• Windows Credential Manager Access via VaultCmd · sigma-rule
• Windows Default Domain GPO Modification · sigma-rule
• Windows Default Domain GPO Modification via GPME · sigma-rule
• Windows Defender Exclusion List Modified · sigma-rule
• Windows Defender Exclusion Registry Key - Write Access Requested · sigma-rule
• Windows Defender Exclusions Added · sigma-rule
• Windows Defender Exclusions Added - PowerShell · sigma-rule
• Windows Defender Exclusions Added - Registry · sigma-rule
• Windows Defender Real-Time Protection Failure/Restart · sigma-rule
• Windows Defender Threat Detection Service Disabled · sigma-rule
• Windows Firewall Disabled via PowerShell · sigma-rule
• Windows Firewall Profile Disabled · sigma-rule
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE · sigma-rule
• Windows Network Access Suspicious desktop.ini Action · sigma-rule
• Windows Pcap Drivers · sigma-rule
• Windows PowerShell User Agent · sigma-rule
• Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted · sigma-rule
• Windows Recall Feature Enabled - Registry · sigma-rule
• Windows Recall Feature Enabled Via Reg.EXE · sigma-rule
• Windows Recovery Environment Disabled Via Reagentc · sigma-rule
• Windows Registry Trust Record Modification · sigma-rule
• Windows Screen Capture with CopyFromScreen · sigma-rule
• Windows Terminal Profile Settings Modification By Uncommon Process · sigma-rule
• Winlogon AllowMultipleTSSessions Enable · sigma-rule
• Winlogon Helper DLL · sigma-rule
• Winrar Compressing Dump Files · sigma-rule
• WinRAR Execution in Non-Standard Folder · sigma-rule
• WinSock2 Autorun Keys Modification · sigma-rule
• Wlrmdr.EXE Uncommon Argument Or Child Process · sigma-rule
• WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load · sigma-rule
• WMI Event Consumer Created Named Pipe · sigma-rule
• WMI Event Subscription · sigma-rule
• WMI Persistence · sigma-rule
• WMI Persistence - Script Event Consumer · sigma-rule
• WMI Persistence - Security · sigma-rule
• WMIC Loading Scripting Libraries · sigma-rule
• WMIC Remote Command Execution · sigma-rule
• WMIC Unquoted Services Path Lookup - PowerShell · sigma-rule
• WmiPrvSE Spawned A Process · sigma-rule
• Wow6432Node Classes Autorun Keys Modification · sigma-rule
• Wow6432Node CurrentVersion Autorun Keys Modification · sigma-rule
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · sigma-rule
• Write Protect For Storage Disabled · sigma-rule
• Writing Local Admin Share · sigma-rule
• Writing Of Malicious Files To The Fonts Folder · sigma-rule
• Wscript Shell Run In CommandLine · sigma-rule
• WSL Child Process Anomaly · sigma-rule
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE · sigma-rule
• XSL Script Execution Via WMIC.EXE · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Module · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell · sigma-rule
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Script · sigma-rule