attack.execution — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Abusable DLL Potential Sideloading From Suspicious Location · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service · sigma-rule
• Abuse of Service Permissions to Hide Services Via Set-Service - PS · sigma-rule
• Add Insecure Download Source To Winget · sigma-rule
• Add New Download Source To Winget · sigma-rule
• Add Potential Suspicious New Download Source To Winget · sigma-rule
• Adwind RAT / JRAT File Artifact · sigma-rule
• Alternate PowerShell Hosts - PowerShell Module · sigma-rule
• Alternate PowerShell Hosts Pipe · sigma-rule
• AMSI Bypass Pattern Assembly GetType · sigma-rule
• Antivirus Exploitation Framework Detection · sigma-rule
• Antivirus Hacktool Detection · sigma-rule
• Application Removed Via Wmic.EXE · sigma-rule
• Application Termination Attempt via Wmic.EXE · sigma-rule
• AppLocker Prevented Application or Script from Running · sigma-rule
• Arbitrary File Download Via IMEWDBLD.EXE · sigma-rule
• Arbitrary File Download Via MSEDGE_PROXY.EXE · sigma-rule
• Arbitrary File Download Via MSOHTMED.EXE · sigma-rule
• Arbitrary File Download Via MSPUB.EXE · sigma-rule
• Arbitrary File Download Via PresentationHost.EXE · sigma-rule
• Arbitrary File Download Via Squirrel.EXE · sigma-rule
• Arbitrary MSI Download Via Devinit.EXE · sigma-rule
• Arbitrary Shell Command Execution Via Settingcontent-Ms · sigma-rule
• Aruba Network Service Potential DLL Sideloading · sigma-rule
• AspNetCompiler Execution · sigma-rule
• Audit CVE Event · sigma-rule
• AWS EC2 Startup Shell Script Change · sigma-rule
• AWS IAM S3Browser LoginProfile Creation · sigma-rule
• AWS IAM S3Browser Templated S3 Bucket Policy Creation · sigma-rule
• AWS IAM S3Browser User or AccessKey Creation · sigma-rule
• Azure Kubernetes CronJob · sigma-rule
• Azure New CloudShell Created · sigma-rule
• Bad Opsec Powershell Code Artifacts · sigma-rule
• Base64 Encoded PowerShell Command Detected · sigma-rule
• Binary Proxy Execution Via Dotnet-Trace.EXE · sigma-rule
• BITS Transfer Job Download From Direct IP · sigma-rule
• BITS Transfer Job Download From File Sharing Domains · sigma-rule
• BITS Transfer Job Download To Potential Suspicious Folder · sigma-rule
• BITS Transfer Job Downloading File Potential Suspicious Extension · sigma-rule
• BITS Transfer Job With Uncommon Or Suspicious Remote TLD · sigma-rule
• Bitsadmin to Uncommon IP Server Address · sigma-rule
• Bitsadmin to Uncommon TLD · sigma-rule
• BloodHound Collection Files · sigma-rule
• BPFDoor Abnormal Process ID or Lock File Accessed · sigma-rule
• BPFtrace Unsafe Option Usage · sigma-rule
• C# IL Code Compilation Via Ilasm.EXE · sigma-rule
• Capsh Shell Invocation - Linux · sigma-rule
• Certificate Exported Via PowerShell · sigma-rule
• Change PowerShell Policies to an Insecure Level · sigma-rule
• Change PowerShell Policies to an Insecure Level - PowerShell · sigma-rule
• Changing Existing Service ImagePath Value Via Reg.EXE · sigma-rule
• Cisco Modify Configuration · sigma-rule
• Clfs.SYS Loaded By Process Located In a Potential Suspicious Location · sigma-rule
• Clipboard Access Via OSAScript · sigma-rule
• CLR DLL Loaded Via Office Applications · sigma-rule
• Cmd.EXE Missing Space Characters Execution Anomaly · sigma-rule
• CMSTP Execution Process Access · sigma-rule
• CMSTP Execution Process Creation · sigma-rule
• CMSTP Execution Registry Event · sigma-rule
• CMSTP UAC Bypass via COM Object Access · sigma-rule
• CobaltStrike Service Installations - Security · sigma-rule
• CobaltStrike Service Installations - System · sigma-rule
• Code Injection by ld.so Preload · sigma-rule
• Command Line Execution with Suspicious URL and AppData Strings · sigma-rule
• Computer System Reconnaissance Via Wmic.EXE · sigma-rule
• Conhost Spawned By Uncommon Parent Process · sigma-rule
• Conhost.exe CommandLine Path Traversal · sigma-rule
• Control Panel Items · sigma-rule
• ConvertTo-SecureString Cmdlet Usage Via CommandLine · sigma-rule
• Created Files by Microsoft Sync Center · sigma-rule
• Creation Of Non-Existent System DLL · sigma-rule
• Creation of WerFault.exe/Wer.dll in Unusual Folder · sigma-rule
• Credential Dumping Tools Service Execution - Security · sigma-rule
• Credential Dumping Tools Service Execution - System · sigma-rule
• Csc.EXE Execution Form Potentially Suspicious Parent · sigma-rule
• Cscript/Wscript Uncommon Script Extension Execution · sigma-rule
• CSExec Service File Creation · sigma-rule
• CSExec Service Installation · sigma-rule
• Data Export From MSSQL Table Via BCP.EXE · sigma-rule
• Deno Runtime Spawns Shell Or Scripting Interpreter · sigma-rule
• Detection of PowerShell Execution via Sqlps.exe · sigma-rule
• DHCP Callout DLL Installation · sigma-rule
• DHCP Server Error Failed Loading the CallOut DLL · sigma-rule
• DHCP Server Loaded the CallOut DLL · sigma-rule
• DLL Execution Via Register-cimprovider.exe · sigma-rule
• DLL Load via LSASS · sigma-rule
• DLL Search Order Hijackig Via Additional Space in Path · sigma-rule
• DLL Sideloading by VMware Xfer Utility · sigma-rule
• DLL Sideloading Of ShellChromeAPI.DLL · sigma-rule
• DNS Events Related To Mining Pools · sigma-rule
• DNS Query by Finger Utility · sigma-rule
• DNS Query Request By Regsvr32.EXE · sigma-rule
• DNS Server Error Failed Loading the ServerLevelPluginDLL · sigma-rule
• DotNET Assembly DLL Loaded Via Office Application · sigma-rule
• DotNet CLR DLL Loaded By Scripting Applications · sigma-rule
• Download From Suspicious TLD - Blacklist · sigma-rule
• Download From Suspicious TLD - Whitelist · sigma-rule
• DSInternals Suspicious PowerShell Cmdlets · sigma-rule
• DSInternals Suspicious PowerShell Cmdlets - ScriptBlock · sigma-rule
• Elevated System Shell Spawned From Uncommon Parent Location · sigma-rule
• Enable Microsoft Dynamic Data Exchange · sigma-rule
• Enabling COR Profiler Environment Variables · sigma-rule
• Equation Group Indicators · sigma-rule
• ESXi Account Creation Via ESXCLI · sigma-rule
• ESXi Admin Permission Assigned To Account Via ESXCLI · sigma-rule
• ESXi Network Configuration Discovery Via ESXCLI · sigma-rule
• ESXi Storage Information Discovery Via ESXCLI · sigma-rule
• ESXi Syslog Configuration Change Via ESXCLI · sigma-rule
• ESXi System Information Discovery Via ESXCLI · sigma-rule
• ESXi VM Kill Via ESXCLI · sigma-rule
• ESXi VM List Discovery Via ESXCLI · sigma-rule
• ESXi VSAN Information Discovery Via ESXCLI · sigma-rule
• Exchange PowerShell Snap-Ins Usage · sigma-rule
• Execute Code with Pester.bat · sigma-rule
• Execute Code with Pester.bat as Parent · sigma-rule
• Execute Pcwrun.EXE To Leverage Follina · sigma-rule
• Execution of Powershell Script in Public Folder · sigma-rule
• F5 BIG-IP iControl Rest API Command Execution - Webserver · sigma-rule
• Fax Service DLL Search Order Hijack · sigma-rule
• File Download From IP Based URL Via CertOC.EXE · sigma-rule
• File Download Via Bitsadmin · sigma-rule
• File Download Via Bitsadmin To A Suspicious Target Folder · sigma-rule
• File With Suspicious Extension Downloaded Via Bitsadmin · sigma-rule
• File With Uncommon Extension Created By An Office Application · sigma-rule
• FileFix - Command Evidence in TypedPaths · sigma-rule
• Flash Player Update from Suspicious Location · sigma-rule
• Forfiles Command Execution · sigma-rule
• GAC DLL Loaded Via Office Applications · sigma-rule
• HackTool - Bloodhound/Sharphound Execution · sigma-rule
• HackTool - CACTUSTORCH Remote Thread Creation · sigma-rule
• HackTool - CobaltStrike BOF Injection Pattern · sigma-rule
• HackTool - Covenant PowerShell Launcher · sigma-rule
• HackTool - CrackMapExec Execution · sigma-rule
• HackTool - CrackMapExec Execution Patterns · sigma-rule
• HackTool - CrackMapExec PowerShell Obfuscation · sigma-rule
• HackTool - Default PowerSploit/Empire Scheduled Task Creation · sigma-rule
• HackTool - Empire PowerShell Launch Parameters · sigma-rule
• HackTool - HandleKatz Duplicating LSASS Handle · sigma-rule
• HackTool - Impacket Tools Execution · sigma-rule
• HackTool - Jlaive In-Memory Assembly Execution · sigma-rule
• HackTool - Koadic Execution · sigma-rule
• HackTool - LittleCorporal Generated Maldoc Injection · sigma-rule
• HackTool - NetExec File Indicators · sigma-rule
• HackTool - PCHunter Execution · sigma-rule
• HackTool - Potential Impacket Lateral Movement Activity · sigma-rule
• HackTool - Powerup Write Hijack DLL · sigma-rule
• HackTool - RedMimicry Winnti Playbook Execution · sigma-rule
• HackTool - SharPersist Execution · sigma-rule
• HackTool - SharpUp PrivEsc Tool Execution · sigma-rule
• HackTool - SharpWSUS/WSUSpendu Execution · sigma-rule
• HackTool - Sliver C2 Implant Activity Pattern · sigma-rule
• HackTool - Stracciatella Execution · sigma-rule
• HackTool - WinPwn Execution · sigma-rule
• HackTool - WinPwn Execution - ScriptBlock · sigma-rule
• Hacktool Ruler · sigma-rule
• HackTool Service Registration or Execution · sigma-rule
• Hardware Model Reconnaissance Via Wmic.EXE · sigma-rule
• Hidden Powershell in Link File Pattern · sigma-rule
• HTML Help HH.EXE Suspicious Child Process · sigma-rule
• Import PowerShell Modules From Suspicious Directories · sigma-rule
• Import PowerShell Modules From Suspicious Directories - ProcCreation · sigma-rule
• Important Scheduled Task Deleted/Disabled · sigma-rule
• Indirect Command Execution By Program Compatibility Wizard · sigma-rule
• Inline Python Execution - Spawn Shell Via OS System Library · sigma-rule
• Install New Package Via Winget Local Manifest · sigma-rule
• Installation of WSL Kali-Linux · sigma-rule
• Interactive AT Job · sigma-rule
• Interactive Bash Suspicious Children · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - PowerShell · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - Security · sigma-rule
• Invoke-Obfuscation CLIP+ Launcher - System · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation COMPRESS OBFUSCATION - System · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell · sigma-rule
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - Security · sigma-rule
• Invoke-Obfuscation RUNDLL LAUNCHER - System · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - Powershell · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - Security · sigma-rule
• Invoke-Obfuscation STDIN+ Launcher - System · sigma-rule
• Invoke-Obfuscation VAR+ Launcher · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - PowerShell · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - PowerShell Module · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - Security · sigma-rule
• Invoke-Obfuscation VAR+ Launcher - System · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security · sigma-rule
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System · sigma-rule
• Invoke-Obfuscation Via Stdin · sigma-rule
• Invoke-Obfuscation Via Stdin - Powershell · sigma-rule
• Invoke-Obfuscation Via Stdin - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Stdin - Security · sigma-rule
• Invoke-Obfuscation Via Stdin - System · sigma-rule
• Invoke-Obfuscation Via Use Clip · sigma-rule
• Invoke-Obfuscation Via Use Clip - Powershell · sigma-rule
• Invoke-Obfuscation Via Use Clip - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use Clip - Security · sigma-rule
• Invoke-Obfuscation Via Use Clip - System · sigma-rule
• Invoke-Obfuscation Via Use MSHTA · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - PowerShell · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - Security · sigma-rule
• Invoke-Obfuscation Via Use MSHTA - System · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - PowerShell · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - PowerShell Module · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - Security · sigma-rule
• Invoke-Obfuscation Via Use Rundll32 - System · sigma-rule
• ISATAP Router Address Was Set · sigma-rule
• Java Running with Remote Debugging · sigma-rule
• JexBoss Command Sequence · sigma-rule
• JScript Compiler Execution · sigma-rule
• JXA In-memory Execution Via OSAScript · sigma-rule
• Kaspersky Endpoint Security Stopped Via CommandLine - Linux · sigma-rule
• Kavremover Dropped Binary LOLBIN Usage · sigma-rule
• Kubernetes Potential Enumeration Activity · sigma-rule
• Launch Agent/Daemon Execution Via Launchctl · sigma-rule
• Linux HackTool Execution · sigma-rule
• Linux Reverse Shell Indicator · sigma-rule
• Local Privilege Escalation Indicator TabTip · sigma-rule
• MacOS Scripting Interpreter AppleScript · sigma-rule
• Malicious Base64 Encoded PowerShell Keywords in Command Lines · sigma-rule
• Malicious DLL File Dropped in the Teams or OneDrive Folder · sigma-rule
• Malicious Nishang PowerShell Commandlets · sigma-rule
• Malicious PowerShell Commandlets - PoshModule · sigma-rule
• Malicious PowerShell Commandlets - ProcessCreation · sigma-rule
• Malicious PowerShell Commandlets - ScriptBlock · sigma-rule
• Malicious PowerShell Keywords · sigma-rule
• Malicious PowerShell Scripts - FileCreation · sigma-rule
• Malicious PowerShell Scripts - PoshModule · sigma-rule
• Malicious ShellIntel PowerShell Commandlets · sigma-rule
• Metasploit Or Impacket Service Installation Via SMB PsExec · sigma-rule
• Microsoft Defender Blocked from Loading Unsigned DLL · sigma-rule
• Microsoft Excel Add-In Loaded From Uncommon Location · sigma-rule
• Microsoft Office DLL Sideload · sigma-rule
• Microsoft Sync Center Suspicious Network Connections · sigma-rule
• Microsoft VBA For Outlook Addin Loaded Via Outlook · sigma-rule
• MITRE BZAR Indicators for Execution · sigma-rule
• MMC Executing Files with Reversed Extensions Using RTLO Abuse · sigma-rule
• MMC Loading Script Engines DLLs · sigma-rule
• MMC20 Lateral Movement · sigma-rule
• Modification of ld.so.preload · sigma-rule
• Modifying Crontab · sigma-rule
• Monitoring For Persistence Via BITS · sigma-rule
• MpiExec Lolbin · sigma-rule
• MSDT Execution Via Answer File · sigma-rule
• MSHTA Execution with Suspicious File Extensions · sigma-rule
• Net WebClient Casing Anomalies · sigma-rule
• Netcat The Powershell Version · sigma-rule
• Network Connection Initiated By Eqnedt32.EXE · sigma-rule
• Network Connection Initiated By Regsvr32.EXE · sigma-rule
• Network Connection Initiated via Finger.EXE · sigma-rule
• Network Connection Initiated Via Notepad.EXE · sigma-rule
• New Application in AppCompat · sigma-rule
• New BITS Job Created Via Bitsadmin · sigma-rule
• New BITS Job Created Via PowerShell · sigma-rule
• New Cron File Created · sigma-rule
• New DNS ServerLevelPluginDll Installed · sigma-rule
• New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE · sigma-rule
• New PowerShell Instance Created · sigma-rule
• Node Process Executions · sigma-rule
• NodeJS Execution of JavaScript File · sigma-rule
• Nohup Execution · sigma-rule
• Non Interactive PowerShell Process Spawned · sigma-rule
• Nslookup PowerShell Download Cradle · sigma-rule
• NTFS Alternate Data Stream · sigma-rule
• Obfuscated PowerShell MSI Install via WindowsInstaller COM · sigma-rule
• Obfuscated PowerShell OneLiner Execution · sigma-rule
• Office Application Initiated Network Connection To Non-Local IP · sigma-rule
• OMIGOD SCX RunAsProvider ExecuteScript · sigma-rule
• OMIGOD SCX RunAsProvider ExecuteShellCommand · sigma-rule
• OpenEDR Spawning Command Shell · sigma-rule
• Operator Bloopers Cobalt Strike Commands · sigma-rule
• Operator Bloopers Cobalt Strike Modules · sigma-rule
• Osacompile Execution By Potentially Suspicious Applet/Osascript · sigma-rule
• OSACompile Run-Only Execution · sigma-rule
• Outbound Network Connection Initiated By Microsoft Dialer · sigma-rule
• Outbound Network Connection To Public IP Via Winlogon · sigma-rule
• Outlook EnableUnsafeClientMailRules Setting Enabled · sigma-rule
• PAExec Service Installation · sigma-rule
• Password Set to Never Expire via WMI · sigma-rule
• Payload Decoded and Decrypted via Built-in Utilities · sigma-rule
• PCRE.NET Package Image Load · sigma-rule
• PCRE.NET Package Temp Files · sigma-rule
• PDQ Deploy Remote Adminstartion Tool Execution · sigma-rule
• Perl Inline Command Execution · sigma-rule
• Persistence and Execution at Scale via GPO Scheduled Task · sigma-rule
• Php Inline Command Execution · sigma-rule
• Possible Privilege Escalation via Weak Service Permissions · sigma-rule
• Potential 7za.DLL Sideloading · sigma-rule
• Potential Abuse of Linux Magic System Request Key · sigma-rule
• Potential Adplus.EXE Abuse · sigma-rule
• Potential Antivirus Software DLL Sideloading · sigma-rule
• Potential appverifUI.DLL Sideloading · sigma-rule
• Potential Arbitrary Code Execution Via Node.EXE · sigma-rule
• Potential Arbitrary Command Execution Via FTP.EXE · sigma-rule
• Potential Arbitrary File Download Via Cmdl32.EXE · sigma-rule
• Potential AVKkid.DLL Sideloading · sigma-rule
• Potential Azure Browser SSO Abuse · sigma-rule
• Potential Binary Impersonating Sysinternals Tools · sigma-rule
• Potential Binary Proxy Execution Via Cdb.EXE · sigma-rule
• Potential CCleanerDU.DLL Sideloading · sigma-rule
• Potential CCleanerReactivator.DLL Sideloading · sigma-rule
• Potential Chrome Frame Helper DLL Sideloading · sigma-rule
• Potential ClickFix Execution Pattern - Registry · sigma-rule
• Potential CobaltStrike Process Patterns · sigma-rule
• Potential CobaltStrike Service Installations - Registry · sigma-rule
• Potential CommandLine Path Traversal Via Cmd.EXE · sigma-rule
• Potential Data Exfiltration Activity Via CommandLine Tools · sigma-rule
• Potential Direct Syscall of NtOpenProcess · sigma-rule
• Potential DLL File Download Via PowerShell Invoke-WebRequest · sigma-rule
• Potential DLL Sideloading Of DBGCORE.DLL · sigma-rule
• Potential DLL Sideloading Of DBGHELP.DLL · sigma-rule
• Potential DLL Sideloading Of DbgModel.DLL · sigma-rule
• Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE · sigma-rule
• Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE · sigma-rule
• Potential DLL Sideloading Of MpSvc.DLL · sigma-rule
• Potential DLL Sideloading Of MsCorSvc.DLL · sigma-rule
• Potential DLL Sideloading Of Non-Existent DLLs From System Folders · sigma-rule
• Potential DLL Sideloading Via ClassicExplorer32.dll · sigma-rule
• Potential DLL Sideloading Via comctl32.dll · sigma-rule
• Potential DLL Sideloading Via DeviceEnroller.EXE · sigma-rule
• Potential DLL Sideloading Via JsSchHlp · sigma-rule
• Potential DLL Sideloading Via VMware Xfer · sigma-rule
• Potential Dosfuscation Activity · sigma-rule
• Potential Dropper Script Execution Via WScript/CScript/MSHTA · sigma-rule
• Potential EACore.DLL Sideloading · sigma-rule
• Potential Edputil.DLL Sideloading · sigma-rule
• Potential Encoded PowerShell Patterns In CommandLine · sigma-rule
• Potential File Download Via MS-AppInstaller Protocol Handler · sigma-rule
• Potential File Extension Spoofing Using Right-to-Left Override · sigma-rule
• Potential Goopdate.DLL Sideloading · sigma-rule
• Potential In-Memory Download And Compile Of Payloads · sigma-rule
• Potential Initial Access via DLL Search Order Hijacking · sigma-rule
• Potential Iviewers.DLL Sideloading · sigma-rule
• Potential JLI.dll Side-Loading · sigma-rule
• Potential Libvlc.DLL Sideloading · sigma-rule
• Potential Mfdetours.DLL Sideloading · sigma-rule
• Potential Mftrace.EXE Abuse · sigma-rule
• Potential Mpclient.DLL Sideloading · sigma-rule
• Potential Mpclient.DLL Sideloading Via Defender Binaries · sigma-rule
• Potential Netcat Reverse Shell Execution · sigma-rule
• Potential Persistence Attempt Via Existing Service Tampering · sigma-rule
• Potential Persistence Via Microsoft Compatibility Appraiser · sigma-rule
• Potential Persistence Via Powershell Search Order Hijacking - Task · sigma-rule
• Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Potential PowerShell Command Line Obfuscation · sigma-rule
• Potential PowerShell Downgrade Attack · sigma-rule
• Potential PowerShell Obfuscation Using Alias Cmdlets · sigma-rule
• Potential PowerShell Obfuscation Using Character Join · sigma-rule
• Potential PowerShell Obfuscation Via Reversed Commands · sigma-rule
• Potential PowerShell Obfuscation Via WCHAR/CHAR · sigma-rule
• Potential Powershell ReverseShell Connection · sigma-rule
• Potential Privilege Escalation via Service Permissions Weakness · sigma-rule
• Potential Process Reconnaissance via Wmic.EXE · sigma-rule
• Potential Product Class Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Product Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Python DLL SideLoading · sigma-rule
• Potential Rcdll.DLL Sideloading · sigma-rule
• Potential Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
• Potential ReflectDebugger Content Execution Via WerFault.EXE · sigma-rule
• Potential Registry Persistence Attempt Via DbgManagedDebugger · sigma-rule
• Potential Registry Persistence Attempt Via Windows Telemetry · sigma-rule
• Potential Remote Command Execution In Pod Container · sigma-rule
• Potential Remote PowerShell Session Initiated · sigma-rule
• Potential Remote SquiblyTwo Technique Execution · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Default Location · sigma-rule
• Potential RjvPlatform.DLL Sideloading From Non-Default Location · sigma-rule
• Potential RoboForm.DLL Sideloading · sigma-rule
• Potential ShellDispatch.DLL Sideloading · sigma-rule
• Potential Sidecar Injection Into Running Deployment · sigma-rule
• Potential SmadHook.DLL Sideloading · sigma-rule
• Potential SMB Relay Attack Tool Execution · sigma-rule
• Potential SolidPDFCreator.DLL Sideloading · sigma-rule
• Potential SSH Tunnel Persistence Install Using A Scheduled Task · sigma-rule
• Potential Suspicious Activity Using SeCEdit · sigma-rule
• Potential Suspicious Browser Launch From Document Reader Process · sigma-rule
• Potential Suspicious PowerShell Keywords · sigma-rule
• Potential System DLL Sideloading From Non System Locations · sigma-rule
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE · sigma-rule
• Potential Vcruntime140 DLL Sideloading · sigma-rule
• Potential Vivaldi_elf.DLL Sideloading · sigma-rule
• Potential Waveedit.DLL Sideloading · sigma-rule
• Potential Wazuh Security Platform DLL Sideloading · sigma-rule
• Potential WinAPI Calls Via CommandLine · sigma-rule
• Potential WinAPI Calls Via PowerShell Scripts · sigma-rule
• Potential Windows Defender Tampering Via Wmic.EXE · sigma-rule
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell · sigma-rule
• Potential WWlib.DLL Sideloading · sigma-rule
• Potential Xterm Reverse Shell · sigma-rule
• Potentially Suspicious ASP.NET Compilation Via AspNetCompiler · sigma-rule
• Potentially Suspicious Child Process of KeyScrambler.exe · sigma-rule
• Potentially Suspicious Child Process Of VsCode · sigma-rule
• Potentially Suspicious Child Process Of WinRAR.EXE · sigma-rule
• Potentially Suspicious Command Executed Via Run Dialog Box - Registry · sigma-rule
• Potentially Suspicious Execution From Parent Process In Public Folder · sigma-rule
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary · sigma-rule
• Potentially Suspicious NTFS Symlink Behavior Modification · sigma-rule
• Potentially Suspicious Powershell Script Execution From Temp Folder · sigma-rule
• Potentially Suspicious Rundll32.EXE Execution of UDL File · sigma-rule
• Potentially Suspicious WebDAV LNK Execution · sigma-rule
• PowerShell ADRecon Execution · sigma-rule
• PowerShell as a Service in Registry · sigma-rule
• PowerShell Base64 Encoded FromBase64String Cmdlet · sigma-rule
• PowerShell Base64 Encoded IEX Cmdlet · sigma-rule
• PowerShell Base64 Encoded Invoke Keyword · sigma-rule
• PowerShell Base64 Encoded Reflective Assembly Load · sigma-rule
• PowerShell Base64 Encoded WMI Classes · sigma-rule
• PowerShell Called from an Executable Version Mismatch · sigma-rule
• PowerShell Core DLL Loaded By Non PowerShell Process · sigma-rule
• PowerShell Create Local User · sigma-rule
• Powershell Create Scheduled Task · sigma-rule
• PowerShell Credential Prompt · sigma-rule
• PowerShell Downgrade Attack - PowerShell · sigma-rule
• PowerShell Download and Execution Cradles · sigma-rule
• PowerShell Download Pattern · sigma-rule
• PowerShell Download Via Net.WebClient - PowerShell Classic · sigma-rule
• Powershell Execute Batch Script · sigma-rule
• Powershell Executed From Headless ConHost Process · sigma-rule
• Powershell Inline Execution From A File · sigma-rule
• PowerShell MSI Install via WindowsInstaller COM From Remote Location · sigma-rule
• Powershell MsXml COM Object · sigma-rule
• PowerShell PSAttack · sigma-rule
• PowerShell Remote Session Creation · sigma-rule
• PowerShell Script Run in AppData · sigma-rule
• PowerShell Scripts Installed as Services · sigma-rule
• PowerShell Scripts Installed as Services - Security · sigma-rule
• PowerShell ShellCode · sigma-rule
• PowerShell Web Access Installation - PsScript · sigma-rule
• Powershell XML Execute Command · sigma-rule
• PowerView PowerShell Cmdlets - ScriptBlock · sigma-rule
• Process Creation Attempt via Wmic.EXE · sigma-rule
• Process Execution From Shared Memory Directory · sigma-rule
• Process Proxy Execution Via Squirrel.EXE · sigma-rule
• ProcessHacker Privilege Elevation · sigma-rule
• Proxy Execution Via Wuauclt.EXE · sigma-rule
• PSAsyncShell - Asynchronous TCP Reverse Shell · sigma-rule
• PSExec and WMI Process Creations Block · sigma-rule
• Psexec Execution · sigma-rule
• PSEXEC Remote Execution File Artefact · sigma-rule
• PsExec Service File Creation · sigma-rule
• PsExec Service Installation · sigma-rule
• PsExec Tool Execution From Suspicious Locations - PipeName · sigma-rule
• PUA - AdvancedRun Execution · sigma-rule
• PUA - CSExec Default Named Pipe · sigma-rule
• PUA - CsExec Execution · sigma-rule
• PUA - NirCmd Execution · sigma-rule
• PUA - NirCmd Execution As LOCAL SYSTEM · sigma-rule
• PUA - NSudo Execution · sigma-rule
• PUA - PAExec Default Named Pipe · sigma-rule
• PUA - Radmin Viewer Utility Execution · sigma-rule
• PUA - RemCom Default Named Pipe · sigma-rule
• PUA - RunXCmd Execution · sigma-rule
• PUA - Wsudo Suspicious Execution · sigma-rule
• Python Inline Command Execution · sigma-rule
• Python One-Liners with Base64 Decoding · sigma-rule
• Python One-Liners with Base64 Decoding - Linux · sigma-rule
• Python Spawning Pretty TTY on Windows · sigma-rule
• Python Spawning Pretty TTY Via PTY Module · sigma-rule
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · sigma-rule
• Read Contents From Stdin Via Cmd.EXE · sigma-rule
• Registry Entries For Azorult Malware · sigma-rule
• Registry Enumeration via WMI Stdregprov · sigma-rule
• Registry Manipulation via WMI Stdregprov · sigma-rule
• Registry Modification Attempt Via VBScript · sigma-rule
• Registry Modification Attempt Via VBScript - PowerShell · sigma-rule
• Registry Modification for OCI DLL Redirection · sigma-rule
• Registry Tampering by Potentially Suspicious Processes · sigma-rule
• Registry-Free Process Scope COR_PROFILER · sigma-rule
• Regsvr32 DLL Execution With Uncommon Extension · sigma-rule
• RemCom Service File Creation · sigma-rule
• RemCom Service Installation · sigma-rule
• Remote Access Tool - ScreenConnect Command Execution · sigma-rule
• Remote Access Tool - ScreenConnect File Transfer · sigma-rule
• Remote Access Tool - ScreenConnect Remote Command Execution · sigma-rule
• Remote Access Tool - ScreenConnect Temporary File · sigma-rule
• Remote Access Tool Services Have Been Installed - Security · sigma-rule
• Remote Access Tool Services Have Been Installed - System · sigma-rule
• Remote DCOM/WMI Lateral Movement · sigma-rule
• Remote DLL Load Via Rundll32.EXE · sigma-rule
• Remote LSASS Process Access Through Windows Remote Management · sigma-rule
• Remote PowerShell Session (PS Classic) · sigma-rule
• Remote PowerShell Session (PS Module) · sigma-rule
• Remote PowerShell Session Host Process (WinRM) · sigma-rule
• Remote PowerShell Sessions Network Connections (WinRM) · sigma-rule
• Remote Schedule Task Lateral Movement via ATSvc · sigma-rule
• Remote Schedule Task Lateral Movement via ITaskSchedulerService · sigma-rule
• Remote Schedule Task Lateral Movement via SASec · sigma-rule
• Remote Server Service Abuse for Lateral Movement · sigma-rule
• Remote Task Creation via ATSVC Named Pipe · sigma-rule
• Remote Task Creation via ATSVC Named Pipe - Zeek · sigma-rule
• Remote Thread Creation Ttdinject.exe Proxy · sigma-rule
• Remote Thread Creation Via PowerShell In Uncommon Target · sigma-rule
• Remotely Hosted HTA File Executed Via Mshta.EXE · sigma-rule
• Renamed CURL.EXE Execution · sigma-rule
• Renamed FTP.EXE Execution · sigma-rule
• Renamed Jusched.EXE Execution · sigma-rule
• Renamed NirCmd.EXE Execution · sigma-rule
• Renamed PingCastle Binary Execution · sigma-rule
• Renamed Powershell Under Powershell Channel · sigma-rule
• Renamed Schtasks Execution · sigma-rule
• Renamed Vmnat.exe Execution · sigma-rule
• Restricted Software Access By SRP · sigma-rule
• Ruby Inline Command Execution · sigma-rule
• Run PowerShell Script from Redirected Input Stream · sigma-rule
• Rundll32 Execution Without Parameters · sigma-rule
• Rundll32 Internet Connection · sigma-rule
• Rundll32 UNC Path Execution · sigma-rule
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE · sigma-rule
• Scheduled Cron Task/Job - Linux · sigma-rule
• Scheduled Cron Task/Job - MacOs · sigma-rule
• Scheduled Task Creation Masquerading as System Processes · sigma-rule
• Scheduled Task Creation Via Schtasks.EXE · sigma-rule
• Scheduled Task Creation with Curl and PowerShell Execution Combo · sigma-rule
• Scheduled Task Executed From A Suspicious Location · sigma-rule
• Scheduled Task Executed Uncommon LOLBIN · sigma-rule
• Scheduled Task Executing Encoded Payload from Registry · sigma-rule
• Scheduled Task Executing Payload from Registry · sigma-rule
• Scheduled Task/Job At · sigma-rule
• Scheduled TaskCache Change by Uncommon Program · sigma-rule
• Schtasks Creation Or Modification With SYSTEM Privileges · sigma-rule
• Schtasks From Suspicious Folders · sigma-rule
• Script Event Consumer Spawning Process · sigma-rule
• Script Interpreter Execution From Suspicious Folder · sigma-rule
• Script Interpreter Spawning Credential Scanner - Linux · sigma-rule
• Script Interpreter Spawning Credential Scanner - Windows · sigma-rule
• Service DACL Abuse To Hide Services Via Sc.EXE · sigma-rule
• Service Reconnaissance Via Wmic.EXE · sigma-rule
• Service Registry Key Read Access Request · sigma-rule
• Service Registry Permissions Weakness Check · sigma-rule
• Service Security Descriptor Tampering Via Sc.EXE · sigma-rule
• Service Started/Stopped Via Wmic.EXE · sigma-rule
• Service Startup Type Change Via Wmic.EXE · sigma-rule
• Service StartupType Change Via PowerShell Set-Service · sigma-rule
• Service StartupType Change Via Sc.EXE · sigma-rule
• Setup16.EXE Execution With Custom .Lst File · sigma-rule
• Shell Execution via Git - Linux · sigma-rule
• Shell Execution via Rsync - Linux · sigma-rule
• Shell Invocation via Env Command - Linux · sigma-rule
• Shell Invocation Via Ssh - Linux · sigma-rule
• Shell32 DLL Execution in Suspicious Directory · sigma-rule
• Silence.EDA Detection · sigma-rule
• Silenttrinity Stager Msbuild Activity · sigma-rule
• Sliver C2 Default Service Installation · sigma-rule
• smbexec.py Service Installation · sigma-rule
• SQL Client Tools PowerShell Session Detection · sigma-rule
• Start Windows Service Via Net.EXE · sigma-rule
• Successful Account Login Via WMI · sigma-rule
• Suspicious Activity in Shell Commands · sigma-rule
• Suspicious ArcSOC.exe Child Process · sigma-rule
• Suspicious Autorun Registry Modified via WMI · sigma-rule
• Suspicious Binaries and Scripts in Public Folder · sigma-rule
• Suspicious Binary In User Directory Spawned From Office Application · sigma-rule
• Suspicious Browser Child Process - MacOS · sigma-rule
• Suspicious Child Process of AspNetCompiler · sigma-rule
• Suspicious Child Process Of BgInfo.EXE · sigma-rule
• Suspicious ClickFix/FileFix Execution Pattern · sigma-rule
• Suspicious Command Patterns In Scheduled Task Creation · sigma-rule
• Suspicious Commands Linux · sigma-rule
• Suspicious Csi.exe Usage · sigma-rule
• Suspicious Deno File Written from Remote Source · sigma-rule
• Suspicious Download and Execute Pattern via Curl/Wget · sigma-rule
• Suspicious Download From Direct IP Via Bitsadmin · sigma-rule
• Suspicious Download From File-Sharing Website Via Bitsadmin · sigma-rule
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call · sigma-rule
• Suspicious Encoded PowerShell Command Line · sigma-rule
• Suspicious Encoded Scripts in a WMI Consumer · sigma-rule
• Suspicious Execution of Powershell with Base64 · sigma-rule
• Suspicious Execution via macOS Script Editor · sigma-rule
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix · sigma-rule
• Suspicious File Characteristics Due to Missing Fields · sigma-rule
• Suspicious File Created by ArcSOC.exe · sigma-rule
• Suspicious File Created In PerfLogs · sigma-rule
• Suspicious File Execution From Internet Hosted WebDav Share · sigma-rule
• Suspicious FileFix Execution Pattern · sigma-rule
• Suspicious Filename with Embedded Base64 Commands · sigma-rule
• Suspicious Greedy Compression Using Rar.EXE · sigma-rule
• Suspicious GUP Usage · sigma-rule
• Suspicious HH.EXE Execution · sigma-rule
• Suspicious HWP Sub Processes · sigma-rule
• Suspicious Installer Package Child Process · sigma-rule
• Suspicious Interactive PowerShell as SYSTEM · sigma-rule
• Suspicious Invocation of Shell via AWK - Linux · sigma-rule
• Suspicious Invocation of Shell via Rsync · sigma-rule
• Suspicious Java Children Processes · sigma-rule
• Suspicious LNK Command-Line Padding with Whitespace Characters · sigma-rule
• Suspicious Microsoft Office Child Process · sigma-rule
• Suspicious Microsoft Office Child Process - MacOS · sigma-rule
• Suspicious Modification Of Scheduled Tasks · sigma-rule
• Suspicious Mshta.EXE Execution Patterns · sigma-rule
• Suspicious Non PowerShell WSMAN COM Provider · sigma-rule
• Suspicious Outlook Child Process · sigma-rule
• Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script · sigma-rule
• Suspicious PowerShell Download - PoshModule · sigma-rule
• Suspicious PowerShell Download - Powershell Script · sigma-rule
• Suspicious PowerShell Download and Execute Pattern · sigma-rule
• Suspicious PowerShell Encoded Command Patterns · sigma-rule
• Suspicious PowerShell IEX Execution Patterns · sigma-rule
• Suspicious PowerShell Invocation From Script Engines · sigma-rule
• Suspicious PowerShell Invocations - Generic · sigma-rule
• Suspicious PowerShell Invocations - Generic - PowerShell Module · sigma-rule
• Suspicious PowerShell Invocations - Specific · sigma-rule
• Suspicious PowerShell Invocations - Specific - PowerShell Module · sigma-rule
• Suspicious PowerShell Parameter Substring · sigma-rule
• Suspicious PowerShell Parent Process · sigma-rule
• Suspicious Printer Driver Empty Manufacturer · sigma-rule
• Suspicious Process Created Via Wmic.EXE · sigma-rule
• Suspicious Program Names · sigma-rule
• Suspicious RASdial Activity · sigma-rule
• Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
• Suspicious Remote Child Process From Outlook · sigma-rule
• Suspicious Reverse Shell Command Line · sigma-rule
• Suspicious Runscripthelper.exe · sigma-rule
• Suspicious Scan Loop Network · sigma-rule
• Suspicious Scheduled Task Creation · sigma-rule
• Suspicious Scheduled Task Creation Involving Temp Folder · sigma-rule
• Suspicious Scheduled Task Creation via Masqueraded XML File · sigma-rule
• Suspicious Scheduled Task Name As GUID · sigma-rule
• Suspicious Scheduled Task Update · sigma-rule
• Suspicious Scheduled Task Write to System32 Tasks · sigma-rule
• Suspicious Schtasks Execution AppData Folder · sigma-rule
• Suspicious Schtasks Schedule Type With High Privileges · sigma-rule
• Suspicious Schtasks Schedule Types · sigma-rule
• Suspicious Scripting in a WMI Consumer · sigma-rule
• Suspicious Service DACL Modification Via Set-Service Cmdlet - PS · sigma-rule
• Suspicious Space Characters in RunMRU Registry Path - ClickFix · sigma-rule
• Suspicious Space Characters in TypedPaths Registry Path - FileFix · sigma-rule
• Suspicious Spool Service Child Process · sigma-rule
• Suspicious Startup Folder Persistence · sigma-rule
• Suspicious Unsigned Thor Scanner Execution · sigma-rule
• Suspicious Usage of For Loop with Recursive Directory Search in CMD · sigma-rule
• Suspicious Use of CSharp Interactive Console · sigma-rule
• Suspicious WMIC Execution Via Office Process · sigma-rule
• Suspicious WmiPrvSE Child Process · sigma-rule
• Suspicious WSMAN Provider Image Loads · sigma-rule
• Suspicious XOR Encoded PowerShell Command · sigma-rule
• Suspicious ZipExec Execution · sigma-rule
• Symlink Etc Passwd · sigma-rule
• Sysprep on AppData Folder · sigma-rule
• System Control Panel Item Loaded From Uncommon Location · sigma-rule
• System Disk And Volume Reconnaissance Via Wmic.EXE · sigma-rule
• T1047 Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Tasks Folder Evasion · sigma-rule
• Third Party Software DLL Sideloading · sigma-rule
• Triple Cross eBPF Rootkit Default Persistence · sigma-rule
• Trusted Path Bypass via Windows Directory Spoofing · sigma-rule
• UAC Bypass Using IDiagnostic Profile · sigma-rule
• UAC Bypass Using IDiagnostic Profile - File · sigma-rule
• UAC Bypass With Fake DLL · sigma-rule
• Uncommon Child Process Of Appvlp.EXE · sigma-rule
• Uncommon Child Process Of BgInfo.EXE · sigma-rule
• Uncommon Child Process Of Defaultpack.EXE · sigma-rule
• Uncommon One Time Only Scheduled Task At 00:00 · sigma-rule
• Unsigned .node File Loaded · sigma-rule
• Unsigned Binary Loaded From Suspicious Location · sigma-rule
• Unsigned Mfdetours.DLL Sideloading · sigma-rule
• Unsigned Module Loaded by ClickOnce Application · sigma-rule
• Unusual Parent Process For Cmd.EXE · sigma-rule
• Usage Of Web Request Commands And Cmdlets · sigma-rule
• Usage Of Web Request Commands And Cmdlets - ScriptBlock · sigma-rule
• Use of FSharp Interpreters · sigma-rule
• Use Of Hidden Paths Or Files · sigma-rule
• Use of OpenConsole · sigma-rule
• Use of Pcalua For Execution · sigma-rule
• Use of Remote.exe · sigma-rule
• Use of Scriptrunner.exe · sigma-rule
• Use Of The SFTP.EXE Binary As A LOLBIN · sigma-rule
• Use of TTDInject.exe · sigma-rule
• Use of VSIISExeLauncher.exe · sigma-rule
• Use of Wfc.exe · sigma-rule
• Using SettingSyncHost.exe as LOLBin · sigma-rule
• VBA DLL Loaded Via Office Application · sigma-rule
• Vim GTFOBin Abuse - Linux · sigma-rule
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution · sigma-rule
• Visual Studio NodejsTools PressAnyKey Renamed Execution · sigma-rule
• VMGuestLib DLL Sideload · sigma-rule
• VMMap Signed Dbghelp.DLL Potential Sideloading · sigma-rule
• VMMap Unsigned Dbghelp.DLL Potential Sideloading · sigma-rule
• VMToolsd Suspicious Child Process · sigma-rule
• WFP Filter Added via Registry · sigma-rule
• Windows AppX Deployment Full Trust Package Installation · sigma-rule
• Windows AppX Deployment Unsigned Package Installation · sigma-rule
• Windows Binary Executed From WSL · sigma-rule
• Windows Defender AMSI Trigger Detected · sigma-rule
• Windows Defender Exclusions Added - PowerShell · sigma-rule
• Windows Defender Threat Detected · sigma-rule
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE · sigma-rule
• Windows MSIX Package Support Framework AI_STUBS Execution · sigma-rule
• Windows Shell/Scripting Application File Write to Suspicious Folder · sigma-rule
• Windows Shell/Scripting Processes Spawning Suspicious Programs · sigma-rule
• WMI Event Consumer Created Named Pipe · sigma-rule
• WMIC Remote Command Execution · sigma-rule
• WMIC Unquoted Services Path Lookup - PowerShell · sigma-rule
• Wmiexec Default Output File · sigma-rule
• WMImplant Hack Tool · sigma-rule
• WmiPrvSE Spawned A Process · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack · sigma-rule
• Wmiprvse Wbemcomn DLL Hijack - File · sigma-rule
• Writing Of Malicious Files To The Fonts Folder · sigma-rule
• WScript or CScript Dropper - File · sigma-rule
• Wscript Shell Run In CommandLine · sigma-rule
• WSL Child Process Anomaly · sigma-rule
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE · sigma-rule
• XSL Script Execution Via WMIC.EXE · sigma-rule
• Xwizard.EXE Execution From Non-Default Location · sigma-rule