Public Domain Built-in Rules

The following table shows the public domain built-in rules incorporated into FortiSIEM.

Rules that are adopted from the SIGMA rule set are licensed under the Detection Rule License available here.

FortiSIEM Rule	Author	Source Link
AWS CloudTrail Important Changes	vitaliy0x1	https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws_cloudtrail_disable_logging.yml
AWS EC2 Userdata Download	faloker	https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws_ec2_download_userdata.yml
Linux: Attempt to Disable Crowdstrike Service	Ömer Günal	https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_security_tools_disabling.yml
Linux: Attempt to Disable CarbonBlack Service	Ömer Günal	https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_security_tools_disabling.yml
Windows: Turla Service Install	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_carbonpaper_turla.yml
Windows: StoneDrill Service Install	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_stonedrill.yml
Windows: Turla PNG Dropper Service	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_turla_service_png.yml
Windows: smbexec.py Service Installation	Omer Faruk Celik	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_hack_smbexec.yml
Windows: Malicious Service Installations	Florian Roth, Daniil Yugoslavskiy, oscd.community (update)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_service_installs.yml
Windows: Meterpreter or Cobalt Strike Getsystem Service Installation	Teymur Kheirkhabarov, Ecco	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
Windows: PsExec Tool Execution	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_tool_psexec.yml
Windows: Local User Creation	Patrick Bareiss	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_creation.yml
Windows: Local User Creation Via Powershell	@ROxPinTeddy	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_create_local_user.yml
Windows: Local User Creation Via Net.exe	Endgame, JHasenbusch (adapted to sigma for oscd.community)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_net_user_add.yml
Windows: Suspicious ANONYMOUS LOGON Local Account Created	James Pemberton / @4A616D6573	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_local_anon_logon_created.yml
Windows: New or Renamed User Account with $ in Attribute SamAccountName	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_new_or_renamed_user_account_with_dollar_sign.yml
Windows: AD Privileged Users or Groups Reconnaissance	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_account_discovery.yml
Windows: Administrator and Domain Admin Reconnaissance	Florian Roth (rule), Jack Croock (method)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_net_recon_activity.yml
Windows: Access to ADMIN$ Share	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_admin_share_access.yml
Windows: Login with WMI	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_wmi_login.yml
Windows: Admin User Remote Logon	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_admin_rdp_login.yml
Windows: RDP Login from Localhost	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_localhost_login.yml
Windows: Interactive Logon to Server Systems	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_interactive_logons.yml
Windows: Pass the Hash Activity	Ilias el Matani (rule), The Information Assurance Directorate at the NSA (method)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_pass_the_hash.yml
Windows: Pass the Hash Activity 2	Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_pass_the_hash_2.yml
Windows: Successful Overpass the Hash Attempt	Roberto Rodriguez (source), Dominik Schaudel (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_overpass_the_hash.yml
Windows: RottenPotato Like Attack Pattern	@SBousseaden, Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_rottenpotato.yml
Windows: Hacktool Ruler	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_ruler.yml
Windows: Metasploit SMB Authentication	Chakib Gzenayi (@Chak092), Hosni Mribah	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_metasploit_authentication.yml
Windows: Kerberos Manipulation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_kerberos_manipulation.yml
Windows: Suspicious Kerberos RC4 Ticket Encryption	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_rc4_kerberos.yml
Windows: Persistence and Execution at Scale via GPO Scheduled Task	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_GPO_scheduledtasks.yml
Windows: Powerview Add-DomainObjectAcl DCSync AD Extend Right	Samir Bousseaden; Roberto Rodriguez @Cyb3rWard0g; oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_account_backdoor_dcsync_rights.yml
Windows: AD Object WriteDAC Access	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_object_writedac_access.yml
Windows: Active Directory Replication from Non Machine Account	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_replication_non_machine_account.yml
Windows: AD User Enumeration	Maxime Thiebaut (@0xThiebaut)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_user_enumeration.yml
Windows: Enabled User Right in AD to Control User Objects	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_active_directory_user_control.yml
Windows: Eventlog Cleared	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_eventlog_cleared.yml
Windows: MSHTA Suspicious Execution 01	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_mshta_execution.yml
Windows: Dumpert Process Dumper	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_hack_dumpert.yml
Windows: Blue Mockingbird	Trent Liffick (@tliffick)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_blue_mockingbird.yml
Windows: Windows PowerShell Web Request	James Pemberton / @4A616D6573	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/win_powershell_web_request.yml
Windows: DNS Tunnel Technique from MuddyWater	@caliskanfurkan_	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_apt_muddywater_dnstunnel.yml
Windows: Advanced IP Scanner Detected	@ROxPinTeddy	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_advanced_ip_scanner.yml
Windows: APT29 Detected	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_apt29_thinktanks.yml
Windows: Baby Shark Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_babyshark.yml
Windows: Judgement Panda Credential Access Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_bear_activity_gtr19.yml
Windows: Logon Scripts - UserInitMprLogonScript	Tom Ueltschi (@c_APT_ure)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml
Windows: BlueMashroom DLL Load	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_bluemashroom.yml
Windows: Password Change on Directory Service Restore Mode DSRM Account	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_dsrm_password_change.yml
Windows: Account Tampering - Suspicious Failed Logon Reasons	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logon_reasons.yml
Windows: Backup Catalog Deleted	Florian Roth (rule), Tom U. @c_APT_ure (collection)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_backup_delete.yml
Windows: Failed Code Integrity Checks	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_codeintegrity_check_failure.yml
Windows: DHCP Server Loaded the CallOut DLL	Dimitrios Slamaris	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_dhcp_config.yml
Windows: Suspicious LDAP-Attributes Used	xknow @xknow_infosec	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_ldap_dataexchange.yml
Windows: Password Dumper Activity on LSASS		https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_lsass_dump.yml
Windows: Generic Password Dumper Activity on LSASS	Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_lsass_dump_generic.yml
Windows: Suspicious PsExec Execution	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_psexec.yml
Windows: Suspicious Access to Sensitive File Extensions	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_raccess_sensitive_fext.yml
Windows: Secure Deletion with SDelete	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_sdelete.yml
Windows: Unauthorized System Time Modification	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_time_modification.yml
Windows: Windows Defender Exclusion Set	@BarryShooshooga	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_defender_bypass.yml
Windows: Windows Pcap Driver Installed	Cian Heasley	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_pcap_drivers.yml
Windows: Weak Encryption Enabled and Kerberoast	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_enable_weak_encryption.yml
Windows: Remote Task Creation via ATSVC Named Pipe	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_atsvc_task.yml
Windows: Chafer Activity	Florian Roth, Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_chafer_mar18.yml
Windows: WMIExec VBS Script	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_cloudhopper.yml
Windows: CrackMapExecWin Activity	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_dragonfly.yml
Windows: Elise Backdoor	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_elise.yml
Windows: Emissary Panda Malware SLLauncher Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_emissarypanda_sep19.yml
Windows: Empire Monkey Activity	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_empiremonkey.yml
Windows: Equation Group DLL-U Load	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_equationgroup_dll_u_load.yml
Windows: EvilNum Golden Chickens Deployment via OCX Files	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_evilnum_jul20.yml
Windows: GALLIUM Artefacts Via Hash Match	Tim Burrell	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_gallium.yml
Windows: GALLIUM Artefacts Via Hash and Process Match	Tim Burrell	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_gallium.yml
Windows: Windows Credential Editor Startup	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_hack_wce.yml
Windows: Greenbug Campaign Indicators	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_greenbug_may20.yml
Windows: Hurricane Panda Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_hurricane_panda.yml
Windows: Judgement Panda Exfiltration Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_judgement_panda_gtr19.yml
Windows: Ke3chang Registry Key Modifications	Markus Neis, Swisscom	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_ke3chang_regadd.yml
Windows: Lazarus Session Highjacker	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_lazarus_session_highjack.yml
Windows: Mustang Panda Dropper Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_mustangpanda.yml
Windows: Defrag Deactivation	Florian Roth, Bartlomiej Czyz (@bczyz1)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_slingshot.yml
Windows: Sofacy Trojan Loader Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_sofacy.yml
Windows: Ps.exe Renamed SysInternals Tool	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_ta17_293a_ps.yml
Windows: TAIDOOR RAT DLL Load	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_taidoor.yml
Windows: TropicTrooper Campaign November 2018	@41thexplorer, Microsoft Defender ATP	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_tropictrooper.yml
Windows: Turla Group Commands May 2020	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_turla_comrat_may20.yml
Windows: Unidentified Attacker November 2018 Activity 1	@41thexplorer, Microsoft Defender ATP	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_unidentified_nov_18.yml
Windows: Unidentified Attacker November 2018 Activity 2	@41thexplorer, Microsoft Defender ATP	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_unidentified_nov_18.yml
Windows: Winnti Malware HK University Campaign	Florian Roth, Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_winnti_mal_hk_jan20.yml
Windows: Winnti Pipemon Characteristics	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_winnti_pipemon.yml
Windows: Operation Wocao Activity	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_wocao.yml
Windows: ZxShell Malware	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_zxshell.yml
Windows: Active Directory User Backdoors	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_ad_user_backdoors.yml
Windows: Mimikatz DC Sync	Benjamin Delpy, Florian Roth, Scott Dermott	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dcsync.yml
Windows: Windows Event Auditing Disabled	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_disable_event_logging.yml
Windows: DPAPI Domain Backup Key Extraction	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_backupkey_extraction.yml
Windows: DPAPI Domain Master Key Backup Attempt	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_masterkey_backup_attempt.yml
Windows: External Disk Drive or USB Storage Device	Keith Wright	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_external_device.yml
Windows: Possible Impacket SecretDump Remote Activity	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_impacket_secretdump.yml
Windows: Obfuscated Powershell IEX invocation	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml
Windows: First Time Seen Remote Named Pipe	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_lm_namedpipe.yml
Windows: LSASS Access from Non-System Account	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_lsass_access_non_system_account.yml
Windows: Credential Dumping Tools Service Execution	Florian Roth, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_creddumper.yml
Windows: WCE wceaux dll Access	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_wceaux_dll.yml
Windows: MMC20 Lateral Movement	@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mmc20_lateral_movement.yml
Windows: NetNTLM Downgrade Attack	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_net_ntlm_downgrade.yml
Windows: Denied Access To Remote Desktop	Pushkarev Dmitry	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_not_allowed_rdp_access.yml
Windows: Possible DCShadow	Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_possible_dc_shadow.yml
Windows: Protected Storage Service Access	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_protected_storage_service_access.yml
Windows: Scanner PoC for CVE-2019-0708 RDP RCE Vuln	Florian Roth (rule), Adam Bradbury (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_bluekeep_poc_scanner.yml
Windows: RDP over Reverse SSH Tunnel	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_reverse_tunnel.yml
Windows: Register new Logon Process by Rubeus	Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_register_new_logon_process_by_rubeus.yml
Windows: Remote PowerShell Sessions	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_remote_powershell_session.yml
Windows: Remote Registry Management Using Reg Utility	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_remote_registry_management_using_reg_utility.yml
Windows: SAM Registry Hive Handle Request	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_sam_registry_hive_handle_request.yml
Windows: SCM Database Handle Failure	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_scm_database_handle_failure.yml
Windows: SCM Database Privileged Operation	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_scm_database_privileged_operation.yml
Windows: Addition of Domain Trusts	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_add_domain_trust.yml
Windows: Addition of SID History to Active Directory Object	Thomas Patzke, @atc_project (improvements)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_add_sid_history.yml
Windows: Failed Logon From Public IP	NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logon_source.yml
Windows: Failed Logins with Different Accounts from Single Source System	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logons_single_source.yml
Windows: Remote Service Activity via SVCCTL Named Pipe	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_svcctl_remote_service.yml
Windows: SysKey Registry Keys Access	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_syskey_registry_access.yml
Windows: Tap Driver Installation	Daniil Yugoslavskiy, Ian Davis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_tap_driver_installation.yml
Windows: Transferring Files with Credential Data via Network Shares	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_transferring_files_with_credential_data_via_network_shares.yml
Windows: User Added to Local Administrators	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_added_to_local_administrators.yml
Windows: Failed to Call Privileged Service LsaRegisterLogonProcess	Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_couldnt_call_privileged_service_lsaregisterlogonprocess.yml
Windows: Suspicious Driver Loaded By User	xknow (@xknow_infosec), xorxes (@xor_xes)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_driver_loaded.yml
Windows: Suspicious Driver Load from Temp	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/sysmon_susp_driver_load.yml
Windows: File Created with System Process Name	Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_creation_system_file.yml
Windows: Credential Dump Tools Dropped Files	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_cred_dump_tools_dropped_files.yml
Windows: Detection of SafetyKatz	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_ghostpack_safetykatz.yml
Windows: LSASS Memory Dump File Creation	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_lsass_memory_dump_file_creation.yml
Windows: Microsoft Office Add-In Loading	NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_office_persistence.yml
Windows: QuarksPwDump Dump File	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_quarkspw_filedump.yml
Windows: RedMimicry Winnti Playbook Dropped File	Alexander Rausch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_redmimicry_winnti_filedrop.yml
Windows: Suspicious ADSI-Cache Usage By Unknown Tool	xknow @xknow_infosec	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_adsi_cache_usage.yml
Windows: Suspicious desktop.ini Action	Maxime Thiebaut (@0xThiebaut)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_desktop_ini.yml
Windows: Suspicious PROCEXP152 sys File Created In TMP	xknow (@xknow_infosec), xorxes (@xor_xes)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
Windows: Hijack Legit RDP Session to Move Laterally	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_tsclient_filewrite_startup.yml
Windows: Windows Web shell Creation	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_webshell_creation_detect.yml
Windows: WMI Persistence - Script Event Consumer File Write	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_wmi_persistence_script_event_consumer_write.yml
Windows: Suspicious Desktopimgdownldr Target File	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/win_susp_desktopimgdownldr_file.yml
Windows: In-memory PowerShell	Tom Kern, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_in_memory_powershell.yml
Windows: PowerShell load within System Management Automation DLL	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_powershell_execution_moduleload.yml
Windows: Fax Service DLL Search Order Hijack	NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_fax_dll.yml
Windows: Possible Process Hollowing Image Loading	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_image_load.yml
Windows: .NET DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml
Windows: CLR DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_clr_dll_load.yml
Windows: GAC DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_gac_dll_load.yml
Windows: Active Directory Parsing DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dsparse_dll_load.yml
Windows: Active Directory Kerberos DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_kerberos_dll_load.yml
Windows: VBA DLL Loaded Via Office Applications	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_winword_vbadll_load.yml
Windows: WMI DLL Loaded Via Office Applications	Michael R. (@nahamike01)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_winword_wmidll_load.yml
Windows: Loading dbghelp dbgcore DLL from Suspicious Processes	Perez Diego (@darkquassar), oscd.community, Ecco	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_suspicious_dbghelp_dbgcore_load.yml
Windows: Svchost DLL Search Order Hijack	SBousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_svchost_dll_search_order_hijack.yml
Windows: Unsigned Image Loaded Into LSASS Process	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_unsigned_image_loaded_into_lsass.yml
Windows: Suspicious WMI Modules Loaded	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_wmi_module_load.yml
Windows: WMI Persistence - Command Line Event Consumer	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_wmi_persistence_commandline_event_consumer.yml
Windows: Registry Entries Found For Azorult Malware	Trent Liffick	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/mal_azorult_reg.yml
Windows: Registry Entries Found For FlowCloud Malware	NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_flowcloud.yml
Windows: Octopus Scanner Malware Detected	NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_octopus_scanner.yml
Windows: Registry Entries For Ursnif Malware	megan201296	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_ursnif.yml
Windows: Dllhost.exe Internet Connection	bartblaze	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_dllhost_net_connections.yml
Windows: Suspicious Typical Malware Back Connect Ports	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_malware_backconnect_ports.yml
Windows: Notepad Making Network Connection	EagleEye Team	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_notepad_network_connection.yml
Windows: PowerShell Network Connections	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_powershell_network_connection.yml
Windows: RDP Over Reverse SSH Tunnel	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_rdp_reverse_tunnel.yml
Windows: Regsvr32 Network Activity	Dmitriy Lifanov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_regsvr32_network_activity.yml
Windows: Remote PowerShell Session	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_remote_powershell_session_network.yml
Windows: Rundll32 Internet Connection	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml
Windows: Network Connections From Executables in Suspicious Program Locations	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_susp_prog_location_network_connection.yml
Windows: Outbound RDP Connections From Suspicious Executables	Markus Neis - Swisscom	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_susp_rdp.yml
Windows: Outbound Kerberos Connection From Suspicious Executables	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_suspicious_outbound_kerberos_connection.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_suspicious_outbound_kerberos_connection.yml
Windows: Microsoft Binary Github Communication	Michael Haag (idea), Florian Roth (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_win_binary_github_com.yml
Windows: Microsoft Binary Suspicious External Communication	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_win_binary_susp_com.yml
Windows: Data Compressed - Powershell	Timur Zinniatullin, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_data_compressed.yml
Windows: Dnscat Execution	Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_dnscat_execution.yml
Windows: PowerShell Credential Prompt	John Lambert (idea), Florian Roth (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_prompt_credentials.yml
Windows: Powershell Profile ps1 Modification	HieuTT35	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_suspicious_profile_create.yml
Windows: Credentials Dumping Tools Accessing LSASS Memory	Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (update)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_cred_dump_lsass_access.yml
Windows: Suspicious In-Memory Module Execution	Perez Diego (@darkquassar), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_in_memory_assembly_execution.yml
Windows: Suspect Svchost Memory Asccess	Tim Burrell	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_invoke_phantom.yml
Windows: Credential Dumping by LaZagne	Bhabesh Raj	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_lazagne_cred_dump_lsass_access.yml
Windows: LSASS Memory Dump	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_lsass_memdump.yml
Windows: Malware Shellcode in Verclsid Target Process	John Lambert (tech), Florian Roth (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_malware_verclsid_shellcode.yml
Windows: Mimikatz through Windows Remote Management	Patryk Prauze - ING Tech	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_mimikatz_trough_winrm.yml
Windows: Turla Group Lateral Movement	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_turla_commands.yml
Windows: Hiding Files with Attrib exe	Sami Ruohonen	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_attrib_hiding_files.yml
Windows: Modification of Boot Configuration	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_bootconf_mod.yml
Windows: SquiblyTwo	Markus Neis / Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_bypass_squiblytwo.yml
Windows: Change Default File Association	Timur Zinniatullin, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_change_default_file_association.yml
Windows: Cmdkey Cached Credentials Recon	jmallette	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_cmdkey_recon.yml
Windows: CMSTP UAC Bypass via COM Object Access	Nik Seetharaman	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_cmstp_com_object_access.yml
Windows: Cmd exe CommandLine Path Traversal	xknow @xknow_infosec	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_commandline_path_traversal.yml
Windows: Unusual Control Panel Items	Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_control_panel_item.yml
Windows: Copying Sensitive Files with Credential Data	Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_copying_sensitive_files_with_credential_data.yml
Windows: Fireball Archer Malware Install	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_fireball.yml
Windows: Maze Ransomware	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_maze_ransomware.yml
Windows: Snatch Ransomware	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_snatch_ransomware.yml
Windows: Data Compressed - rar.exe	Timur Zinniatullin, E.M. Anhaus, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_data_compressed_with_rar.yml
Windows: DNS Exfiltration and Tunneling Tools Execution	Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dns_exfiltration_tools_execution.yml
Windows: DNSCat2 Powershell Detection Via Process Creation	Cian Heasley	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dnscat2_powershell_implementation.yml
Windows: Encoded FromBase64String	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_frombase64string.yml
Windows: Encoded IEX	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_iex.yml
Windows: COMPlus-ETWEnabled Command Line Arguments	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_etw_modification_cmdline.yml
Windows: Disabling ETW Trace	@neu5ron, Florian Roth, Jonhnathan Ribeiro, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_etw_trace_evasion.yml
Windows: Exfiltration and Tunneling Tools Execution	Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exfiltration_and_tunneling_tools_execution.yml
Windows: Exploit for CVE-2015-1641	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2015_1641.yml
Windows: Exploit for CVE-2017-0261	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_0261.yml
Windows: Droppers Exploiting CVE-2017-11882	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_11882.yml
Windows: Exploit for CVE-2017-8759	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_8759.yml
Windows: Exploiting SetupComplete.cmd CVE-2019-1378	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2019_1378.yml
Windows: Exploiting CVE-2019-1388	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2019_1388.yml
Windows: Exploited CVE-2020-10189 Zoho ManageEngine	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_10189.yml
Windows: Suspicious PrinterPorts Creation CVE-2020-1048	EagleEye Team, Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_1048.yml
Windows: DNS RCE CVE-2020-1350	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_1350.yml
Windows: File/Folder Permissions Modifications Via Command line Utilities	Jakob Weinzettl, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_file_permission_modifications.yml
Windows: Grabbing Sensitive Hives via Reg Utility	Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_grabbing_sensitive_hives_via_reg.yml
Windows: Bloodhound and Sharphound Hack Tool	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_bloodhound.yml
Windows: Koadic Execution	wagga	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_koadic.yml
Windows: Rubeus Hack Tool	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml
Windows: SecurityXploded Tool	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_secutyxploded.yml
Windows: HH exe Execution	E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hh_chm.yml
Windows: CreateMiniDump Hacktool	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hktl_createminidump.yml
Windows: HTML Help Shell Spawn	Maxim Pavlunin	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_html_help_spawn.yml
Windows: Suspicious HWP Sub Processes	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hwp_exploits.yml
Windows: Impacket Lateralization Detection	Ecco	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_impacket_lateralization.yml
Windows: Indirect Command Execution	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_indirect_cmd.yml
Windows: Suspicious Debugger Registration Cmdline	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_install_reg_debugger_backdoor.yml
Windows: Interactive AT Job	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_interactive_at.yml
Windows: Invoke-Obfuscation Obfuscated IEX Invocation when to create process	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_invoke_obfuscation_obfuscated_iex_commandline.yml
Windows: Windows Kernel and 3rd-Party Drivers Exploits Token Stealing	Teymur Kheirkhabarov (source), Daniil Yugoslavskiy (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml
Windows: MSHTA Spawned by SVCHOST	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_lethalhta.yml
Windows: Local Accounts Discovery	Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_local_system_owner_account_discovery.yml
Windows: LSASS Memory Dumping Using procdump	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_lsass_dump.yml
Windows: Adwind Remote Access Tool JRAT	Florian Roth, Tom Ueltschi	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mal_adwind.yml
Windows: Dridex Process Pattern	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_dridex.yml
Windows: DTRACK Malware Process Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_dtrack.yml
Windows: Emotet Malware Process Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_emotet.yml
Windows: Formbook Malware Process Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_formbook.yml
Windows: QBot Process Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_qbot.yml
Windows: Ryuk Ransomware	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_ryuk.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_ryuk.yml
Windows: WScript or CScript Dropper	Margaritis Dimitrios (idea), Florian Roth (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_script_dropper.yml
Windows: Trickbot Malware Recon Activity	David Burkett, Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_trickbot_recon_activity.yml
Windows: WannaCry Ransomware	Florian Roth (rule), Tom U. @c_APT_ure (collection)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_wannacry.yml
Windows: MavInject Process Injection	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mavinject_proc_inj.yml
Windows: Meterpreter or Cobalt Strike Getsystem Service Start	Teymur Kheirkhabarov, Ecco	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_meterpreter_or_cobaltstrike_getsystem_service_start.yml
Windows: Mimikatz Command Line	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mimikatz_command_line.yml
Windows: MMC Spawning Windows Shell	Karneades, Swisscom CSIRT	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mmc_spawn_shell.yml
Windows: Mouse Lock Credential Gathering	Cian Heasley	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mouse_lock.yml
Windows: Mshta JavaScript Execution	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mshta_javascript.yml
Windows: MSHTA Spawning Windows Shell	Michael Haag	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mshta_spawn_shell.yml
Windows: Quick Execution of a Series of Suspicious Commands	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_multiple_suspicious_cli.yml
Windows: Windows Network Enumeration	Endgame, JHasenbusch (ported for oscd.community)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_net_enum.yml
Windows: Netsh RDP Port Opening	Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_allow_port_rdp.yml
Windows: Netsh Port or Application Allowed	Markus Neis, Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_fw_add.yml
Windows: Netsh Program Allowed with Suspcious Location	Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_fw_add_susp_image.yml
Windows: Network Trace with netsh exe	Kutepov Anton, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_packet_capture.yml
Windows: Netsh Port Forwarding	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_port_fwd.yml
Windows: Netsh RDP Port Forwarding	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_port_fwd_3389.yml
Windows: Harvesting of Wifi Credentials Using netsh exe	Andreas Hunkeler (@Karneades)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_wifi_credential_harvesting.yml
Windows: Network Sniffing	Timur Zinniatullin, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_network_sniffing.yml
Windows: New Service Creation via sc.exe	Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_new_service_creation.yml
Windows: Non Interactive PowerShell	Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_non_interactive_powershell.yml
Windows: Microsoft Office Product Spawning Windows Shell	Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_office_shell.yml
Windows: MS Office Product Spawning Exe in User Directory	Jason Lynch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_office_spawn_exe_from_users_directory.yml
Windows: Executable Used by PlugX in Uncommon Location	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_plugx_susp_exe_locations.yml
Windows: Possible Applocker Bypass	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_possible_applocker_bypass.yml
Windows: Detection of Possible Rotten Potato	Teymur Kheirkhabarov	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_possible_privilege_escalation_using_rotten_potato.yml
Windows: Powershell AMSI Bypass via NET Reflection	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_amsi_bypass.yml
Windows: Audio Capture via PowerShell	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_audio_capture.yml
Windows: PowerShell Base64 Encoded Shellcode	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_b64_shellcode.yml
Windows: Suspicious Bitsadmin Job via PowerShell	Endgame, JHasenbusch (ported to sigma for oscd.community)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_bitsjob.yml
Windows: Suspicious PowerShell Execution via DLL	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_dll_execution.yml
Windows: PowerShell Downgrade Attack	Harish Segar (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_downgrade_attack.yml
Windows: Download via PowerShell URL	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_download.yml
Windows: FromBase64String Command Line	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_frombase64string.yml
Windows: Suspicious PowerShell Parameter Substring	Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_suspicious_parameter_variation.yml
Windows: Suspicious XOR Encoded PowerShell Command Line	Sami Ruohonen, Harish Segar (improvement)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_xor_commandline.yml
Windows: Default PowerSploit and Empire Schtasks Persistence	Markus Neis, @Karneades	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powersploit_empire_schtasks.yml
Windows: Windows Important Process Started From Suspicious Parent Directories	vburov	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_proc_wrong_parent.yml
Windows: Bitsadmin Download	Michael Haag	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_process_creation_bitsadmin_download.yml
Windows: Process Dump via Rundll32 and Comsvcs dll	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_process_dump_rundll32_comsvcs.yml
Windows: PsExec Service Start	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_psexesvc_start.yml
Windows: Query Registry	Timur Zinniatullin, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_query_registry.yml
Windows: MSTSC Shadowing	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_rdp_hijack_shadowing.yml
Windows: RedMimicry Winnti Playbook Execute	Alexander Rausch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_redmimicry_winnti_proc.yml
Windows: Remote PowerShell Session for creating process	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_remote_powershell_session_process.yml
Windows: System Time Discovery	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_remote_time_discovery.yml
Windows: Renamed Binary	Matthew Green - @mgreen27, Ecco, James Pemberton / @4A616D6573, oscd.community (improvements), Andreas Hunkeler (@Karneades)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_binary.yml
Windows: Highly Relevant Renamed Binary	Matthew Green - @mgreen27, Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_binary_highly_relevant.yml
Windows: Renamed jusched exe	Markus Neis, Swisscom	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_jusched.yml
Windows: Execution of Renamed PaExec	Jason Lynch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_paexec.yml
Windows: Renamed PowerShell	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_powershell.yml
Windows: Renamed ProcDump	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_procdump.yml
Windows: Renamed PsExec	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_psexec.yml
Windows: Run PowerShell Script from ADS	Sergey Soldatov, Kaspersky Lab, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_run_powershell_script_from_ads.yml
Windows: Possible Shim Database Persistence via sdbinst exe	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_sdbinst_shim_persistence.yml
Windows: Manual Service Execution	Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_service_execution.yml
Windows: Stop Windows Service	Jakob Weinzettl, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_service_stop.yml
Windows: Shadow Copies Access via Symlink	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_access_symlink.yml
Windows: Shadow Copies Creation Using Operating Systems Utilities	Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_creation.yml
Windows: Shadow Copies Deletion Using Operating Systems Utilities	Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_deletion.yml
Windows: Windows Shell Spawning Suspicious Program	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml
Windows: SILENTTRINITY Stager Execution	Aleksey Potapov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_silenttrinity_stage_use.yml
Windows: Audio Capture via SoundRecorder	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_soundrec_audio_capture.yml
Windows: Possible SPN Enumeration	Markus Neis, keepwatch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_spn_enum.yml
Windows: Possible Ransomware or Unauthorized MBR Modifications	@neu5ron	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_bcdedit.yml
Windows: Application Allowlisting Bypass via Bginfo	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_bginfo.yml
Windows: Suspicious Calculator Usage	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_calc.yml
Windows: Possible App Allowlisting Bypass via WinDbg CDB as a Shell code Runner	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cdb.yml
Windows: Suspicious Certutil Command	Florian Roth, juju4, keepwatch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_certutil_command.yml
Windows: Certutil Encode	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_certutil_encode.yml
Windows: Suspicious Commandline Escape	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cli_escape.yml
Windows: Command Line Execution with Suspicious URL and AppData Strings	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cmd_http_appdata.yml
Windows: Suspicious Code Page Switch	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_codepage_switch.yml
Windows: Reconnaissance Activity with Net Command	Florian Roth, Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_commands_recon_activity.yml
Windows: Suspicious Compression Tool Parameters	Florian Roth, Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_compression_params.yml
Windows: Process Dump via Comsvcs DLL	Modexp (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_comsvcs_procdump.yml
Windows: Copy from Admin Share	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_copy_lateral_movement.yml
Windows: Suspicious Copy From or To System32	Florian Roth, Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_copy_system32.yml
Windows: Covenant Launcher Indicators	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_covenant.yml
Windows: CrackMapExec Command Execution	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_crackmapexec_execution.yml
Windows: CrackMapExec PowerShell Obfuscation	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_crackmapexec_powershell_obfuscation.yml
Windows: Suspicious Parent of Csc.exe	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_csc.yml
Windows: Suspicious Csc.exe Source File Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_csc_folder.yml
Windows: Suspicious Curl Usage on Windows	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_download.yml
Windows: Suspicious Curl File Upload	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_fileupload.yml
Windows: Curl Start Combination	Sreeman	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_start_combo.yml
Windows: ZOHO Dctask64 Process Injection	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dctask64_proc_inject.yml
Windows: Suspicious Desktopimgdownldr Command	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_desktopimgdownldr.yml
Windows: Devtoolslauncher.exe Executing Specified Binary	Beyu Denis, oscd.community (rule), @_felamos (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_devtoolslauncher.yml
Windows: Direct Autorun Keys Modification	Victor Sergeev, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_direct_asep_reg_keys_modification.yml
Windows: Disabled IE Security Features	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_disable_ie_features.yml
Windows: DIT Snapshot Viewer Use	Furkan Caliskan (@caliskanfurkan_)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ditsnap.yml
Windows: Application Allowlisting Bypass via Dnx.exe	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dnx.yml
Windows: Suspicious Double File Extension	Florian Roth (rule), @blu3_team (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_double_extension.yml
Windows: Application Allowlisting Bypass via Dxcap.exe	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dxcap.yml
Windows: Suspicious Eventlog Clear or Configuration Using Wevtutil or Powershell or Wmic	Ecco, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_eventlog_clear.yml
Windows: Executables Started in Suspicious Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_exec_folder.yml
Windows: Execution in Non-Executable Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_execution_path.yml
Windows: Execution in Webserver Root Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_execution_path_webserver.yml
Windows: Explorer Root Flag Process Tree Break	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_explorer_break_proctree.yml
Windows: Suspicious File Characteristics Due to Missing Fields	Markus Neis, Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_file_characteristics.yml
Windows: Findstr Launching lnk File	Trent Liffick	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_findstr_lnk.yml
Windows: Firewall Disabled via Netsh	Fatih Sirin	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_firewall_disable.yml
Windows: Fsutil Suspicious Invocation	Ecco, E.M. Anhaus, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_fsutil_usage.yml
Windows: Suspicious GUP.exe Usage	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_gup.yml
Windows: IIS Native-Code Module Command Line Installation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_iss_module_install.yml
Windows: Windows Defender Download Activity	Matthew Matchen	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_mpcmdrun_download.yml
Windows: Suspicious MsiExec Directory	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msiexec_cwd.yml
Windows: MsiExec Web Install	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msiexec_web_install.yml
Windows: Malicious Payload Download via Office Binaries	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msoffice.yml
Windows: Net.exe Execution For Discovery	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_net_execution.yml
Windows: Suspicious Netsh.DLL Persistence	Victor Sergeev, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_netsh_dll_persistence.yml
Windows: Invocation of Active Directory Diagnostic Tool ntdsutil exe	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ntdsutil.yml
Windows: Application Allowlisting Bypass via DLL Loaded by odbcconf exe	Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_odbcconf.yml
Windows: OpenWith.exe Executing Specified Binary	Beyu Denis, oscd.community (rule), @harr0ey (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_openwith.yml
Windows: Suspicious Execution from Outlook	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_outlook.yml
Windows: Execution in Outlook Temp Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_outlook_temp.yml
Windows: Ping Hex IP	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ping_hex_ip.yml
Windows: Empire PowerShell Launch Parameters	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_empire_launch.yml
Windows: Empire PowerShell UAC Bypass	Ecco	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_empire_uac_bypass.yml
Windows: Suspicious Encoded PowerShell Command Line	Florian Roth, Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
Windows: PowerShell Encoded Character Syntax	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_encoded_param.yml
Windows: Malicious Base64 Encoded PowerShell Keywords in Command Lines	John Lambert (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_hidden_b64_cmd.yml
Windows: Suspicious PowerShell Invocation Based on Parent Process	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_parent_combo.yml
Windows: Suspicious PowerShell Parent Process	Teymur Kheirkhabarov, Harish Segar (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_parent_process.yml
Windows: Suspicious Use of Procdump	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_procdump.yml
Windows: Programs starting from Suspicious Location	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_prog_location_process_starts.yml
Windows: PowerShell Script Run in AppData	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ps_appdata.yml
Windows: PowerShell DownloadFile	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ps_downloadfile.yml
Windows: Psr.exe Capture Screenshots	Beyu Denis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_psr_capture_screenshots.yml
Windows: Rar with Password or Compression Level	@ROxPinTeddy	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rar_flags.yml
Windows: Suspicious RASdial Activity	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rasdial_activity.yml
Windows: Suspicious Reconnaissance Activity via net group or localgroup	Florian Roth, omkar72	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_recon_activity.yml
Windows: Suspicious Regsvr32 Usage	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_regsvr32_anomalies.yml
Windows: Regsvr32 Flags Anomaly	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_regsvr32_flags_anomaly.yml
Windows: Renamed ZOHO Dctask64	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_renamed_dctask64.yml
Windows: Renamed SysInternals Debug View	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_renamed_debugview.yml
Windows: Suspicious Process Start Locations	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_run_locations.yml
Windows: Suspicious Arguments in Rundll32 Usage	juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rundll32_activity.yml
Windows: Suspicious DLL Call by Ordinal	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml
Windows: Scheduled Task Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml
Windows: WSF JSE JS VBA VBE File Execution	Michael Haag	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_script_execution.yml
Windows: Suspicious Service Path Modification	Victor Sergeev, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_service_path_modification.yml
Windows: Squirrel Lolbin	Karneades / Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_squirrel_lolbin.yml
Windows: Suspicious Svchost Process	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_svchost.yml
Windows: Suspect Svchost Activity	David Burkett	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_svchost_no_cli.yml
Windows: Sysprep on AppData Folder	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_sysprep_appdata.yml
Windows: Suspicious SYSVOL Domain Group Policy Access	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_sysvol_access.yml
Windows: Taskmgr Created By Local SYSTEM Account	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_taskmgr_localsystem.yml
Windows: Process Launch from Taskmgr	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_taskmgr_parent.yml
Windows: Suspicious tscon.exe Created By Local SYSTEM Account	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_tscon_localsystem.yml
Windows: Suspicious RDP Redirect Using tscon.exe	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
Windows: Suspicious Use of CSharp Interactive Console	Michael R. (@nahamike01)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_use_of_csharp_console.yml
Windows: Suspicious Userinit Child Process	Florian Roth (rule), Samir Bousseaden (idea)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_userinit_child.yml
Windows: Whoami Execution	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_whoami.yml
Windows: Suspicious WMI Execution	Michael Haag, Florian Roth, juju4	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
Windows: Sysmon Driver Unload	Kirill Kiryanov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_sysmon_driver_unload.yml
Windows: System File Execution Location Anomaly	Florian Roth, Patrick Bareiss	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml
Windows: Tap Installer Execution	Daniil Yugoslavskiy, Ian Davis, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_tap_installer_execution.yml
Windows: Tasks Folder Evasion	Sreeman	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_task_folder_evasion.yml
Windows: Terminal Service Process Spawn	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_termserv_proc_spawn.yml
Windows: Domain Trust Discovery	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, omkar72	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dsquery_domain_trust_discovery.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_trust_discovery.yml
Windows: Bypass UAC via CMSTP	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_cmstp.yml
Windows: Bypass UAC via Fodhelper.exe	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_fodhelper.yml
Windows: Bypass UAC via WSReset exe	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_wsreset.yml
Windows: Possible Privilege Escalation via Weak Service Permissions	Teymur Kheirkhabarov	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml
Windows: Java Running with Remote Debugging	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_vul_java_remote_debugging.yml
Windows: Webshell Detection With Command Line Keywords	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_detection.yml
Windows: Webshell Recon Detection Via CommandLine Processes	Cian Heasley	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_recon_detection.yml
Windows: Shells Spawned by Web Servers	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_spawn.yml
Windows: Run Whoami as SYSTEM	Teymur Kheirkhabarov	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_whoami_as_system.yml
Windows: Windows 10 Scheduled Task SandboxEscaper 0-day	Olaf Hartong	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_win10_sched_task_0day.yml
Windows: WMI Backdoor Exchange Transport Agent	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_backdoor_exchange_transport_agent.yml
Windows: WMI Persistence - Script Event Consumer	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_persistence_script_event_consumer.yml
Windows: WMI Spawning Windows PowerShell	Markus Neis / @Karneades	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_spwns_powershell.yml
Windows: Wmiprvse Spawning Process	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmiprvse_spawning_process.yml
Windows: Microsoft Workflow Compiler	Nik Seetharaman	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_workflow_compiler.yml
Windows: Wsreset UAC Bypass	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wsreset_uac_bypass.yml
Windows: XSL Script Processing	Timur Zinniatullin, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_xsl_script_processing.yml
Windows: Leviathan Registry Key Activity	Aidan Bracher	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_leviathan.yml
Windows: OceanLotus Registry Activity	megan201296	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_oceanlotus_registry.yml
Windows: Pandemic Registry Key	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_pandemic.yml
Windows: Autorun Keys Modification	Victor Sergeev, Daniil Yugoslavskiy, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_asep_reg_keys_modification.yml
Windows: Suspicious New Printer Ports in Registry CVE-2020-1048	EagleEye Team, Florian Roth, NVISO	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_cve-2020-1048.yml
Windows: DHCP Callout DLL Installation	Dimitrios Slamaris	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_dhcp_calloutdll.yml
Windows: Disable Security Events Logging Adding Reg Key MiniNt	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_disable_security_events_logging_adding_reg_key_minint.yml
Windows: DNS ServerLevelPluginDll Install	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_dns_serverlevelplugindll.yml
Windows: COMPlus-ETWEnabled Registry Modification	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_etw_modification.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_etw_disabled.yml
Windows: Windows Credential Editor Install Via Registry	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_hack_wce_reg.yml
Windows: Logon Scripts UserInitMprLogonScript Registry	Tom Ueltschi (@c_APT_ure)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml
Windows: Narrator s Feedback-Hub Persistence	Dmitriy Lifanov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_narrator_feedback_persistance.yml
Windows: New DLL Added to AppCertDlls Registry Key	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_new_dll_added_to_appcertdlls_registry_key.yml
Windows: New DLL Added to AppInit-DLLs Registry Key	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_new_dll_added_to_appinit_dlls_registry_key.yml
Windows: Possible Privilege Escalation via Service Permissions Weakness	Teymur Kheirkhabarov	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml
Windows: RDP Registry Modification	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_rdp_registry_modification.yml
Windows: RDP Sensitive Settings Changed	Samir Bousseaden	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_rdp_settings_hijack.yml
Windows: RedMimicry Winnti Playbook Registry Manipulation	Alexander Rausch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_redmimicry_winnti_reg.yml
Windows: Office Security Settings Changed	Trent Liffick (@tliffick)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_reg_office_security.yml
Windows: Windows Registry Persistence COM Key Linking	Kutepov Anton, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_persistence_key_linking.yml
Windows: Windows Registry Persistence COM Search Order Hijacking	Maxime Thiebaut (@0xThiebaut)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_persistence_search_order.yml
Windows: Windows Registry Trust Record Modification	Antonlovesdnb	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_trust_record_modification.yml
Windows: Security Support Provider SSP Added to LSA Configuration	iwillkeepwatch	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_ssp_added_lsa_config.yml
Windows: Sticky Key Like Backdoor Usage	Florian Roth, @twjackomo	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_stickykey_like_backdoor.yml
Windows: Suspicious RUN Key from Download	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_download_run_key.yml
Windows: DLL Load via LSASS	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_lsass_dll_load.yml
Windows: Suspicious Camera and Microphone Access	Den Iuzvyk	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_mic_cam_access.yml
Windows: Registry Persistence via Explorer Run Key	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_reg_persist_explorer_run.yml
Windows: New RUN Key Pointing to Suspicious Folder	Florian Roth, Markus Neis, Sander Wiebing	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_run_key_img_folder.yml
Windows: Suspicious Service Installed	xknow (@xknow_infosec), xorxes (@xor_xes)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_service_installed.yml
Windows: Suspicious Keyboard Layout Load	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml
Windows: Usage of Sysinternals Tools	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_sysinternals_eula_accepted.yml
Windows: UAC Bypass via Event Viewer	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_uac_bypass_eventvwr.yml
Windows: UAC Bypass via Sdclt	Omer Yampel	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_uac_bypass_sdclt.yml
Windows: Registry Persistence Mechanisms	Karneades	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_win_reg_persistence.yml
Windows: Azure Browser SSO Abuse	Den Iuzvyk	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_abusing_azure_browser_sso.yml
Windows: Executable in ADS	Florian Roth, @0xrawsec	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_ads_executable.yml
Windows: Alternate PowerShell Hosts Pipe	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_alternate_powershell_hosts_pipe.yml
Windows: Turla Group Named Pipes	Markus Neis	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_apt_turla_namedpipes.yml
Windows: CactusTorch Remote Thread Creation	@SBousseaden (detection), Thomas Patzke (rule)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cactustorch.yml
Windows: CMSTP Execution	Nik Seetharaman	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_cmstp_execution.yml
Windows: CobaltStrike Process Injection	Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml
Windows: CreateRemoteThread API and LoadLibrary	Roberto Rodriguez @Cyb3rWard0g	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_createremotethread_loadlibrary.yml
Windows: Cred Dump Tools Via Named Pipes	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cred_dump_tools_named_pipes.yml
Windows: Malicious Named Pipe	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_mal_namedpipes.yml
Windows: Password Dumper Remote Thread in LSASS	Thomas Patzke	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_password_dumper_lsass.yml
Windows: Possible DNS Rebinding	Ilyas Ochkov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_possible_dns_rebinding.yml
Windows: Raw Disk Access Using Illegitimate Tools	Teymur Kheirkhabarov, oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_raw_disk_access_using_illegitimate_tools.yml
Windows: PowerShell Rundll32 Remote Thread Creation	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml
Windows: Suspicious Remote Thread Created	Perez Diego (@darkquassar), oscd.community	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_suspicious_remote_thread.yml
Windows: WMI Event Subscription	Tom Ueltschi (@c_APT_ure)	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_wmi_event_subscription.yml
Windows: Suspicious Scripting in a WMI Consumer	Florian Roth	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_wmi_susp_scripting.yml

Public Domain Built-in Rules

The following table shows the public domain built-in rules incorporated into FortiSIEM.

Rules that are adopted from the SIGMA rule set are licensed under the Detection Rule License available here.

FortiSIEM Rule

Author

Source Link

AWS CloudTrail Important Changes

vitaliy0x1

https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws_cloudtrail_disable_logging.yml

AWS EC2 Userdata Download

faloker

https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws_ec2_download_userdata.yml

Linux: Attempt to Disable Crowdstrike Service

Ömer Günal

https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_security_tools_disabling.yml

Linux: Attempt to Disable CarbonBlack Service

Ömer Günal

https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_security_tools_disabling.yml

Windows: Turla Service Install

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_carbonpaper_turla.yml

Windows: StoneDrill Service Install

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_stonedrill.yml

Windows: Turla PNG Dropper Service

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_apt_turla_service_png.yml

Windows: smbexec.py Service Installation

Omer Faruk Celik

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_hack_smbexec.yml

Windows: Malicious Service Installations

Florian Roth, Daniil Yugoslavskiy, oscd.community (update)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_service_installs.yml

Windows: Meterpreter or Cobalt Strike Getsystem Service Installation

Teymur Kheirkhabarov, Ecco

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_meterpreter_or_cobaltstrike_getsystem_service_installation.yml

Windows: PsExec Tool Execution

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_tool_psexec.yml

Windows: Local User Creation

Patrick Bareiss

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_creation.yml

Windows: Local User Creation Via Powershell

@ROxPinTeddy

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_create_local_user.yml

Windows: Local User Creation Via Net.exe

Endgame, JHasenbusch (adapted to sigma for oscd.community)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_net_user_add.yml

Windows: Suspicious ANONYMOUS LOGON Local Account Created

James Pemberton / @4A616D6573

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_local_anon_logon_created.yml

Windows: New or Renamed User Account with $ in Attribute SamAccountName

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_new_or_renamed_user_account_with_dollar_sign.yml

Windows: AD Privileged Users or Groups Reconnaissance

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_account_discovery.yml

Windows: Administrator and Domain Admin Reconnaissance

Florian Roth (rule), Jack Croock (method)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_net_recon_activity.yml

Windows: Access to ADMIN$ Share

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_admin_share_access.yml

Windows: Login with WMI

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_wmi_login.yml

Windows: Admin User Remote Logon

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_admin_rdp_login.yml

Windows: RDP Login from Localhost

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_localhost_login.yml

Windows: Interactive Logon to Server Systems

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_interactive_logons.yml

Windows: Pass the Hash Activity

Ilias el Matani (rule), The Information Assurance Directorate at the NSA (method)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_pass_the_hash.yml

Windows: Pass the Hash Activity 2

Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_pass_the_hash_2.yml

Windows: Successful Overpass the Hash Attempt

Roberto Rodriguez (source), Dominik Schaudel (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_overpass_the_hash.yml

Windows: RottenPotato Like Attack Pattern

@SBousseaden, Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_rottenpotato.yml

Windows: Hacktool Ruler

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_ruler.yml

Windows: Metasploit SMB Authentication

Chakib Gzenayi (@Chak092), Hosni Mribah

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_metasploit_authentication.yml

Windows: Kerberos Manipulation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_kerberos_manipulation.yml

Windows: Suspicious Kerberos RC4 Ticket Encryption

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_rc4_kerberos.yml

Windows: Persistence and Execution at Scale via GPO Scheduled Task

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_GPO_scheduledtasks.yml

Windows: Powerview Add-DomainObjectAcl DCSync AD Extend Right

Samir Bousseaden; Roberto Rodriguez @Cyb3rWard0g; oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_account_backdoor_dcsync_rights.yml

Windows: AD Object WriteDAC Access

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_object_writedac_access.yml

Windows: Active Directory Replication from Non Machine Account

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_replication_non_machine_account.yml

Windows: AD User Enumeration

Maxime Thiebaut (@0xThiebaut)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_ad_user_enumeration.yml

Windows: Enabled User Right in AD to Control User Objects

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_active_directory_user_control.yml

Windows: Eventlog Cleared

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_eventlog_cleared.yml

Windows: MSHTA Suspicious Execution 01

Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_mshta_execution.yml

Windows: Dumpert Process Dumper

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_hack_dumpert.yml

Windows: Blue Mockingbird

Trent Liffick (@tliffick)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_blue_mockingbird.yml

Windows: Windows PowerShell Web Request

James Pemberton / @4A616D6573

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/win_powershell_web_request.yml

Windows: DNS Tunnel Technique from MuddyWater

@caliskanfurkan_

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_apt_muddywater_dnstunnel.yml

Windows: Advanced IP Scanner Detected

@ROxPinTeddy

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_advanced_ip_scanner.yml

Windows: APT29 Detected

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_apt29_thinktanks.yml

Windows: Baby Shark Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_babyshark.yml

Windows: Judgement Panda Credential Access Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_bear_activity_gtr19.yml

Windows: Logon Scripts - UserInitMprLogonScript

Tom Ueltschi (@c_APT_ure)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_logon_scripts_userinitmprlogonscript_proc.yml

Windows: BlueMashroom DLL Load

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_bluemashroom.yml

Windows: Password Change on Directory Service Restore Mode DSRM Account

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_dsrm_password_change.yml

Windows: Account Tampering - Suspicious Failed Logon Reasons

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logon_reasons.yml

Windows: Backup Catalog Deleted

Florian Roth (rule), Tom U. @c_APT_ure (collection)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_backup_delete.yml

Windows: Failed Code Integrity Checks

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_codeintegrity_check_failure.yml

Windows: DHCP Server Loaded the CallOut DLL

Dimitrios Slamaris

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_dhcp_config.yml

Windows: Suspicious LDAP-Attributes Used

xknow @xknow_infosec

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_ldap_dataexchange.yml

Windows: Password Dumper Activity on LSASS

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_lsass_dump.yml

Windows: Generic Password Dumper Activity on LSASS

Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_lsass_dump_generic.yml

Windows: Suspicious PsExec Execution

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_psexec.yml

Windows: Suspicious Access to Sensitive File Extensions

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_raccess_sensitive_fext.yml

Windows: Secure Deletion with SDelete

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_sdelete.yml

Windows: Unauthorized System Time Modification

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_time_modification.yml

Windows: Windows Defender Exclusion Set

@BarryShooshooga

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_defender_bypass.yml

Windows: Windows Pcap Driver Installed

Cian Heasley

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/other/win_pcap_drivers.yml

Windows: Weak Encryption Enabled and Kerberoast

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_enable_weak_encryption.yml

Windows: Remote Task Creation via ATSVC Named Pipe

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_atsvc_task.yml

Windows: Chafer Activity

Florian Roth, Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_chafer_mar18.yml

Windows: WMIExec VBS Script

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_cloudhopper.yml

Windows: CrackMapExecWin Activity

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_dragonfly.yml

Windows: Elise Backdoor

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_elise.yml

Windows: Emissary Panda Malware SLLauncher Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_emissarypanda_sep19.yml

Windows: Empire Monkey Activity

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_empiremonkey.yml

Windows: Equation Group DLL-U Load

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_equationgroup_dll_u_load.yml

Windows: EvilNum Golden Chickens Deployment via OCX Files

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_evilnum_jul20.yml

Windows: GALLIUM Artefacts Via Hash Match

Tim Burrell

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_gallium.yml

Windows: GALLIUM Artefacts Via Hash and Process Match

Tim Burrell

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_gallium.yml

Windows: Windows Credential Editor Startup

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/sysmon_hack_wce.yml

Windows: Greenbug Campaign Indicators

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_greenbug_may20.yml

Windows: Hurricane Panda Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_hurricane_panda.yml

Windows: Judgement Panda Exfiltration Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_judgement_panda_gtr19.yml

Windows: Ke3chang Registry Key Modifications

Markus Neis, Swisscom

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_ke3chang_regadd.yml

Windows: Lazarus Session Highjacker

Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_lazarus_session_highjack.yml

Windows: Mustang Panda Dropper Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_mustangpanda.yml

Windows: Defrag Deactivation

Florian Roth, Bartlomiej Czyz (@bczyz1)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_slingshot.yml

Windows: Sofacy Trojan Loader Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_sofacy.yml

Windows: Ps.exe Renamed SysInternals Tool

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_ta17_293a_ps.yml

Windows: TAIDOOR RAT DLL Load

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_taidoor.yml

Windows: TropicTrooper Campaign November 2018

@41thexplorer, Microsoft Defender ATP

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_tropictrooper.yml

Windows: Turla Group Commands May 2020

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_turla_comrat_may20.yml

Windows: Unidentified Attacker November 2018 Activity 1

@41thexplorer, Microsoft Defender ATP

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_unidentified_nov_18.yml

Windows: Unidentified Attacker November 2018 Activity 2

@41thexplorer, Microsoft Defender ATP

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_unidentified_nov_18.yml

Windows: Winnti Malware HK University Campaign

Florian Roth, Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_winnti_mal_hk_jan20.yml

Windows: Winnti Pipemon Characteristics

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_winnti_pipemon.yml

Windows: Operation Wocao Activity

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_wocao.yml

Windows: ZxShell Malware

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_zxshell.yml

Windows: Active Directory User Backdoors

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_alert_ad_user_backdoors.yml

Windows: Mimikatz DC Sync

Benjamin Delpy, Florian Roth, Scott Dermott

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dcsync.yml

Windows: Windows Event Auditing Disabled

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_disable_event_logging.yml

Windows: DPAPI Domain Backup Key Extraction

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_backupkey_extraction.yml

Windows: DPAPI Domain Master Key Backup Attempt

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_masterkey_backup_attempt.yml

Windows: External Disk Drive or USB Storage Device

Keith Wright

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_external_device.yml

Windows: Possible Impacket SecretDump Remote Activity

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_impacket_secretdump.yml

Windows: Obfuscated Powershell IEX invocation

Daniel Bohannon (@Mandiant/@FireEye), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_invoke_obfuscation_obfuscated_iex_services.yml

Windows: First Time Seen Remote Named Pipe

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_lm_namedpipe.yml

Windows: LSASS Access from Non-System Account

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_lsass_access_non_system_account.yml

Windows: Credential Dumping Tools Service Execution

Florian Roth, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_creddumper.yml

Windows: WCE wceaux dll Access

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mal_wceaux_dll.yml

Windows: MMC20 Lateral Movement

@2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_mmc20_lateral_movement.yml

Windows: NetNTLM Downgrade Attack

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_net_ntlm_downgrade.yml

Windows: Denied Access To Remote Desktop

Pushkarev Dmitry

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_not_allowed_rdp_access.yml

Windows: Possible DCShadow

Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_possible_dc_shadow.yml

Windows: Protected Storage Service Access

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_protected_storage_service_access.yml

Windows: Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Florian Roth (rule), Adam Bradbury (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_bluekeep_poc_scanner.yml

Windows: RDP over Reverse SSH Tunnel

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_rdp_reverse_tunnel.yml

Windows: Register new Logon Process by Rubeus

Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_register_new_logon_process_by_rubeus.yml

Windows: Remote PowerShell Sessions

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_remote_powershell_session.yml

Windows: Remote Registry Management Using Reg Utility

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_remote_registry_management_using_reg_utility.yml

Windows: SAM Registry Hive Handle Request

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_sam_registry_hive_handle_request.yml

Windows: SCM Database Handle Failure

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_scm_database_handle_failure.yml

Windows: SCM Database Privileged Operation

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_scm_database_privileged_operation.yml

Windows: Addition of Domain Trusts

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_add_domain_trust.yml

Windows: Addition of SID History to Active Directory Object

Thomas Patzke, @atc_project (improvements)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_add_sid_history.yml

Windows: Failed Logon From Public IP

NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logon_source.yml

Windows: Failed Logins with Different Accounts from Single Source System

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_susp_failed_logons_single_source.yml

Windows: Remote Service Activity via SVCCTL Named Pipe

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_svcctl_remote_service.yml

Windows: SysKey Registry Keys Access

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_syskey_registry_access.yml

Windows: Tap Driver Installation

Daniil Yugoslavskiy, Ian Davis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_tap_driver_installation.yml

Windows: Transferring Files with Credential Data via Network Shares

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_transferring_files_with_credential_data_via_network_shares.yml

Windows: User Added to Local Administrators

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_added_to_local_administrators.yml

Windows: Failed to Call Privileged Service LsaRegisterLogonProcess

Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_couldnt_call_privileged_service_lsaregisterlogonprocess.yml

Windows: Suspicious Driver Loaded By User

xknow (@xknow_infosec), xorxes (@xor_xes)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_user_driver_loaded.yml

Windows: Suspicious Driver Load from Temp

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/sysmon_susp_driver_load.yml

Windows: File Created with System Process Name

Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_creation_system_file.yml

Windows: Credential Dump Tools Dropped Files

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_cred_dump_tools_dropped_files.yml

Windows: Detection of SafetyKatz

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_ghostpack_safetykatz.yml

Windows: LSASS Memory Dump File Creation

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_lsass_memory_dump_file_creation.yml

Windows: Microsoft Office Add-In Loading

NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_office_persistence.yml

Windows: QuarksPwDump Dump File

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_quarkspw_filedump.yml

Windows: RedMimicry Winnti Playbook Dropped File

Alexander Rausch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_redmimicry_winnti_filedrop.yml

Windows: Suspicious ADSI-Cache Usage By Unknown Tool

xknow @xknow_infosec

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_adsi_cache_usage.yml

Windows: Suspicious desktop.ini Action

Maxime Thiebaut (@0xThiebaut)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_desktop_ini.yml

Windows: Suspicious PROCEXP152 sys File Created In TMP

xknow (@xknow_infosec), xorxes (@xor_xes)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml

Windows: Hijack Legit RDP Session to Move Laterally

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_tsclient_filewrite_startup.yml

Windows: Windows Web shell Creation

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_webshell_creation_detect.yml

Windows: WMI Persistence - Script Event Consumer File Write

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/sysmon_wmi_persistence_script_event_consumer_write.yml

Windows: Suspicious Desktopimgdownldr Target File

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/win_susp_desktopimgdownldr_file.yml

Windows: In-memory PowerShell

Tom Kern, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_in_memory_powershell.yml

Windows: PowerShell load within System Management Automation DLL

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_powershell_execution_moduleload.yml

Windows: Fax Service DLL Search Order Hijack

NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_fax_dll.yml

Windows: Possible Process Hollowing Image Loading

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_image_load.yml

Windows: .NET DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml

Windows: CLR DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_clr_dll_load.yml

Windows: GAC DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dotnet_gac_dll_load.yml

Windows: Active Directory Parsing DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_dsparse_dll_load.yml

Windows: Active Directory Kerberos DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_office_kerberos_dll_load.yml

Windows: VBA DLL Loaded Via Office Applications

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_winword_vbadll_load.yml

Windows: WMI DLL Loaded Via Office Applications

Michael R. (@nahamike01)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_susp_winword_wmidll_load.yml

Windows: Loading dbghelp dbgcore DLL from Suspicious Processes

Perez Diego (@darkquassar), oscd.community, Ecco

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_suspicious_dbghelp_dbgcore_load.yml

Windows: Svchost DLL Search Order Hijack

SBousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_svchost_dll_search_order_hijack.yml

Windows: Unsigned Image Loaded Into LSASS Process

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_unsigned_image_loaded_into_lsass.yml

Windows: Suspicious WMI Modules Loaded

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_wmi_module_load.yml

Windows: WMI Persistence - Command Line Event Consumer

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_wmi_persistence_commandline_event_consumer.yml

Windows: Registry Entries Found For Azorult Malware

Trent Liffick

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/mal_azorult_reg.yml

Windows: Registry Entries Found For FlowCloud Malware

NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_flowcloud.yml

Windows: Octopus Scanner Malware Detected

NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_octopus_scanner.yml

Windows: Registry Entries For Ursnif Malware

megan201296

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_ursnif.yml

Windows: Dllhost.exe Internet Connection

bartblaze

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_dllhost_net_connections.yml

Windows: Suspicious Typical Malware Back Connect Ports

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_malware_backconnect_ports.yml

Windows: Notepad Making Network Connection

EagleEye Team

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_notepad_network_connection.yml

Windows: PowerShell Network Connections

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_powershell_network_connection.yml

Windows: RDP Over Reverse SSH Tunnel

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_rdp_reverse_tunnel.yml

Windows: Regsvr32 Network Activity

Dmitriy Lifanov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_regsvr32_network_activity.yml

Windows: Remote PowerShell Session

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_remote_powershell_session_network.yml

Windows: Rundll32 Internet Connection

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_rundll32_net_connections.yml

Windows: Network Connections From Executables in Suspicious Program Locations

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_susp_prog_location_network_connection.yml

Windows: Outbound RDP Connections From Suspicious Executables

Markus Neis - Swisscom

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_susp_rdp.yml

Windows: Outbound Kerberos Connection From Suspicious Executables

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_suspicious_outbound_kerberos_connection.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_suspicious_outbound_kerberos_connection.yml

Windows: Microsoft Binary Github Communication

Michael Haag (idea), Florian Roth (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_win_binary_github_com.yml

Windows: Microsoft Binary Suspicious External Communication

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/sysmon_win_binary_susp_com.yml

Windows: Data Compressed - Powershell

Timur Zinniatullin, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_data_compressed.yml

Windows: Dnscat Execution

Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_dnscat_execution.yml

Windows: PowerShell Credential Prompt

John Lambert (idea), Florian Roth (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_prompt_credentials.yml

Windows: Powershell Profile ps1 Modification

HieuTT35

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_suspicious_profile_create.yml

Windows: Credentials Dumping Tools Accessing LSASS Memory

Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (update)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_cred_dump_lsass_access.yml

Windows: Suspicious In-Memory Module Execution

Perez Diego (@darkquassar), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_in_memory_assembly_execution.yml

Windows: Suspect Svchost Memory Asccess

Tim Burrell

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_invoke_phantom.yml

Windows: Credential Dumping by LaZagne

Bhabesh Raj

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_lazagne_cred_dump_lsass_access.yml

Windows: LSASS Memory Dump

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_lsass_memdump.yml

Windows: Malware Shellcode in Verclsid Target Process

John Lambert (tech), Florian Roth (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_malware_verclsid_shellcode.yml

Windows: Mimikatz through Windows Remote Management

Patryk Prauze - ING Tech

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/sysmon_mimikatz_trough_winrm.yml

Windows: Turla Group Lateral Movement

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_apt_turla_commands.yml

Windows: Hiding Files with Attrib exe

Sami Ruohonen

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_attrib_hiding_files.yml

Windows: Modification of Boot Configuration

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_bootconf_mod.yml

Windows: SquiblyTwo

Markus Neis / Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_bypass_squiblytwo.yml

Windows: Change Default File Association

Timur Zinniatullin, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_change_default_file_association.yml

Windows: Cmdkey Cached Credentials Recon

jmallette

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_cmdkey_recon.yml

Windows: CMSTP UAC Bypass via COM Object Access

Nik Seetharaman

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_cmstp_com_object_access.yml

Windows: Cmd exe CommandLine Path Traversal

xknow @xknow_infosec

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_commandline_path_traversal.yml

Windows: Unusual Control Panel Items

Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_control_panel_item.yml

Windows: Copying Sensitive Files with Credential Data

Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_copying_sensitive_files_with_credential_data.yml

Windows: Fireball Archer Malware Install

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_fireball.yml

Windows: Maze Ransomware

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_maze_ransomware.yml

Windows: Snatch Ransomware

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_crime_snatch_ransomware.yml

Windows: Data Compressed - rar.exe

Timur Zinniatullin, E.M. Anhaus, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_data_compressed_with_rar.yml

Windows: DNS Exfiltration and Tunneling Tools Execution

Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dns_exfiltration_tools_execution.yml

Windows: DNSCat2 Powershell Detection Via Process Creation

Cian Heasley

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dnscat2_powershell_implementation.yml

Windows: Encoded FromBase64String

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_frombase64string.yml

Windows: Encoded IEX

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_encoded_iex.yml

Windows: COMPlus-ETWEnabled Command Line Arguments

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_etw_modification_cmdline.yml

Windows: Disabling ETW Trace

@neu5ron, Florian Roth, Jonhnathan Ribeiro, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_etw_trace_evasion.yml

Windows: Exfiltration and Tunneling Tools Execution

Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exfiltration_and_tunneling_tools_execution.yml

Windows: Exploit for CVE-2015-1641

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2015_1641.yml

Windows: Exploit for CVE-2017-0261

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_0261.yml

Windows: Droppers Exploiting CVE-2017-11882

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_11882.yml

Windows: Exploit for CVE-2017-8759

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2017_8759.yml

Windows: Exploiting SetupComplete.cmd CVE-2019-1378

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2019_1378.yml

Windows: Exploiting CVE-2019-1388

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2019_1388.yml

Windows: Exploited CVE-2020-10189 Zoho ManageEngine

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_10189.yml

Windows: Suspicious PrinterPorts Creation CVE-2020-1048

EagleEye Team, Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_1048.yml

Windows: DNS RCE CVE-2020-1350

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_exploit_cve_2020_1350.yml

Windows: File/Folder Permissions Modifications Via Command line Utilities

Jakob Weinzettl, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_file_permission_modifications.yml

Windows: Grabbing Sensitive Hives via Reg Utility

Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_grabbing_sensitive_hives_via_reg.yml

Windows: Bloodhound and Sharphound Hack Tool

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_bloodhound.yml

Windows: Koadic Execution

wagga

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_koadic.yml

Windows: Rubeus Hack Tool

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml

Windows: SecurityXploded Tool

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_secutyxploded.yml

Windows: HH exe Execution

E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hh_chm.yml

Windows: CreateMiniDump Hacktool

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hktl_createminidump.yml

Windows: HTML Help Shell Spawn

Maxim Pavlunin

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_html_help_spawn.yml

Windows: Suspicious HWP Sub Processes

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hwp_exploits.yml

Windows: Impacket Lateralization Detection

Ecco

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_impacket_lateralization.yml

Windows: Indirect Command Execution

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_indirect_cmd.yml

Windows: Suspicious Debugger Registration Cmdline

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_install_reg_debugger_backdoor.yml

Windows: Interactive AT Job

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_interactive_at.yml

Windows: Invoke-Obfuscation Obfuscated IEX Invocation when to create process

Daniel Bohannon (@Mandiant/@FireEye), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_invoke_obfuscation_obfuscated_iex_commandline.yml

Windows: Windows Kernel and 3rd-Party Drivers Exploits Token Stealing

Teymur Kheirkhabarov (source), Daniil Yugoslavskiy (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_kernel_and_3rd_party_drivers_exploits_token_stealing.yml

Windows: MSHTA Spawned by SVCHOST

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_lethalhta.yml

Windows: Local Accounts Discovery

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_local_system_owner_account_discovery.yml

Windows: LSASS Memory Dumping Using procdump

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_lsass_dump.yml

Windows: Adwind Remote Access Tool JRAT

Florian Roth, Tom Ueltschi

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mal_adwind.yml

Windows: Dridex Process Pattern

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_dridex.yml

Windows: DTRACK Malware Process Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_dtrack.yml

Windows: Emotet Malware Process Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_emotet.yml

Windows: Formbook Malware Process Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_formbook.yml

Windows: QBot Process Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_qbot.yml

Windows: Ryuk Ransomware

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/malware/win_mal_ryuk.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_ryuk.yml

Windows: WScript or CScript Dropper

Margaritis Dimitrios (idea), Florian Roth (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_script_dropper.yml

Windows: Trickbot Malware Recon Activity

David Burkett, Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_trickbot_recon_activity.yml

Windows: WannaCry Ransomware

Florian Roth (rule), Tom U. @c_APT_ure (collection)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_malware_wannacry.yml

Windows: MavInject Process Injection

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mavinject_proc_inj.yml

Windows: Meterpreter or Cobalt Strike Getsystem Service Start

Teymur Kheirkhabarov, Ecco

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_meterpreter_or_cobaltstrike_getsystem_service_start.yml

Windows: Mimikatz Command Line

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mimikatz_command_line.yml

Windows: MMC Spawning Windows Shell

Karneades, Swisscom CSIRT

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mmc_spawn_shell.yml

Windows: Mouse Lock Credential Gathering

Cian Heasley

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mouse_lock.yml

Windows: Mshta JavaScript Execution

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mshta_javascript.yml

Windows: MSHTA Spawning Windows Shell

Michael Haag

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_mshta_spawn_shell.yml

Windows: Quick Execution of a Series of Suspicious Commands

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_multiple_suspicious_cli.yml

Windows: Windows Network Enumeration

Endgame, JHasenbusch (ported for oscd.community)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_net_enum.yml

Windows: Netsh RDP Port Opening

Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_allow_port_rdp.yml

Windows: Netsh Port or Application Allowed

Markus Neis, Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_fw_add.yml

Windows: Netsh Program Allowed with Suspcious Location

Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_fw_add_susp_image.yml

Windows: Network Trace with netsh exe

Kutepov Anton, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_packet_capture.yml

Windows: Netsh Port Forwarding

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_port_fwd.yml

Windows: Netsh RDP Port Forwarding

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_port_fwd_3389.yml

Windows: Harvesting of Wifi Credentials Using netsh exe

Andreas Hunkeler (@Karneades)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_netsh_wifi_credential_harvesting.yml

Windows: Network Sniffing

Timur Zinniatullin, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_network_sniffing.yml

Windows: New Service Creation via sc.exe

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_new_service_creation.yml

Windows: Non Interactive PowerShell

Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_non_interactive_powershell.yml

Windows: Microsoft Office Product Spawning Windows Shell

Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_office_shell.yml

Windows: MS Office Product Spawning Exe in User Directory

Jason Lynch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_office_spawn_exe_from_users_directory.yml

Windows: Executable Used by PlugX in Uncommon Location

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_plugx_susp_exe_locations.yml

Windows: Possible Applocker Bypass

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_possible_applocker_bypass.yml

Windows: Detection of Possible Rotten Potato

Teymur Kheirkhabarov

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_possible_privilege_escalation_using_rotten_potato.yml

Windows: Powershell AMSI Bypass via NET Reflection

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_amsi_bypass.yml

Windows: Audio Capture via PowerShell

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_audio_capture.yml

Windows: PowerShell Base64 Encoded Shellcode

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_b64_shellcode.yml

Windows: Suspicious Bitsadmin Job via PowerShell

Endgame, JHasenbusch (ported to sigma for oscd.community)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_bitsjob.yml

Windows: Suspicious PowerShell Execution via DLL

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_dll_execution.yml

Windows: PowerShell Downgrade Attack

Harish Segar (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_downgrade_attack.yml

Windows: Download via PowerShell URL

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_download.yml

Windows: FromBase64String Command Line

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_frombase64string.yml

Windows: Suspicious PowerShell Parameter Substring

Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_suspicious_parameter_variation.yml

Windows: Suspicious XOR Encoded PowerShell Command Line

Sami Ruohonen, Harish Segar (improvement)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powershell_xor_commandline.yml

Windows: Default PowerSploit and Empire Schtasks Persistence

Markus Neis, @Karneades

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_powersploit_empire_schtasks.yml

Windows: Windows Important Process Started From Suspicious Parent Directories

vburov

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_proc_wrong_parent.yml

Windows: Bitsadmin Download

Michael Haag

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_process_creation_bitsadmin_download.yml

Windows: Process Dump via Rundll32 and Comsvcs dll

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_process_dump_rundll32_comsvcs.yml

Windows: PsExec Service Start

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_psexesvc_start.yml

Windows: Query Registry

Timur Zinniatullin, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_query_registry.yml

Windows: MSTSC Shadowing

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_rdp_hijack_shadowing.yml

Windows: RedMimicry Winnti Playbook Execute

Alexander Rausch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_redmimicry_winnti_proc.yml

Windows: Remote PowerShell Session for creating process

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_remote_powershell_session_process.yml

Windows: System Time Discovery

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_remote_time_discovery.yml

Windows: Renamed Binary

Matthew Green - @mgreen27, Ecco, James Pemberton / @4A616D6573, oscd.community (improvements), Andreas Hunkeler (@Karneades)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_binary.yml

Windows: Highly Relevant Renamed Binary

Matthew Green - @mgreen27, Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_binary_highly_relevant.yml

Windows: Renamed jusched exe

Markus Neis, Swisscom

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_jusched.yml

Windows: Execution of Renamed PaExec

Jason Lynch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_paexec.yml

Windows: Renamed PowerShell

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_powershell.yml

Windows: Renamed ProcDump

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_procdump.yml

Windows: Renamed PsExec

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_renamed_psexec.yml

Windows: Run PowerShell Script from ADS

Sergey Soldatov, Kaspersky Lab, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_run_powershell_script_from_ads.yml

Windows: Possible Shim Database Persistence via sdbinst exe

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_sdbinst_shim_persistence.yml

Windows: Manual Service Execution

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_service_execution.yml

Windows: Stop Windows Service

Jakob Weinzettl, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_service_stop.yml

Windows: Shadow Copies Access via Symlink

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_access_symlink.yml

Windows: Shadow Copies Creation Using Operating Systems Utilities

Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_creation.yml

Windows: Shadow Copies Deletion Using Operating Systems Utilities

Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shadow_copies_deletion.yml

Windows: Windows Shell Spawning Suspicious Program

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml

Windows: SILENTTRINITY Stager Execution

Aleksey Potapov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_silenttrinity_stage_use.yml

Windows: Audio Capture via SoundRecorder

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_soundrec_audio_capture.yml

Windows: Possible SPN Enumeration

Markus Neis, keepwatch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_spn_enum.yml

Windows: Possible Ransomware or Unauthorized MBR Modifications

@neu5ron

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_bcdedit.yml

Windows: Application Allowlisting Bypass via Bginfo

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_bginfo.yml

Windows: Suspicious Calculator Usage

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_calc.yml

Windows: Possible App Allowlisting Bypass via WinDbg CDB as a Shell code Runner

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cdb.yml

Windows: Suspicious Certutil Command

Florian Roth, juju4, keepwatch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_certutil_command.yml

Windows: Certutil Encode

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_certutil_encode.yml

Windows: Suspicious Commandline Escape

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cli_escape.yml

Windows: Command Line Execution with Suspicious URL and AppData Strings

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_cmd_http_appdata.yml

Windows: Suspicious Code Page Switch

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_codepage_switch.yml

Windows: Reconnaissance Activity with Net Command

Florian Roth, Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_commands_recon_activity.yml

Windows: Suspicious Compression Tool Parameters

Florian Roth, Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_compression_params.yml

Windows: Process Dump via Comsvcs DLL

Modexp (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_comsvcs_procdump.yml

Windows: Copy from Admin Share

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_copy_lateral_movement.yml

Windows: Suspicious Copy From or To System32

Florian Roth, Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_copy_system32.yml

Windows: Covenant Launcher Indicators

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_covenant.yml

Windows: CrackMapExec Command Execution

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_crackmapexec_execution.yml

Windows: CrackMapExec PowerShell Obfuscation

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_crackmapexec_powershell_obfuscation.yml

Windows: Suspicious Parent of Csc.exe

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_csc.yml

Windows: Suspicious Csc.exe Source File Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_csc_folder.yml

Windows: Suspicious Curl Usage on Windows

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_download.yml

Windows: Suspicious Curl File Upload

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_fileupload.yml

Windows: Curl Start Combination

Sreeman

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_curl_start_combo.yml

Windows: ZOHO Dctask64 Process Injection

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dctask64_proc_inject.yml

Windows: Suspicious Desktopimgdownldr Command

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_desktopimgdownldr.yml

Windows: Devtoolslauncher.exe Executing Specified Binary

Beyu Denis, oscd.community (rule), @_felamos (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_devtoolslauncher.yml

Windows: Direct Autorun Keys Modification

Victor Sergeev, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_direct_asep_reg_keys_modification.yml

Windows: Disabled IE Security Features

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_disable_ie_features.yml

Windows: DIT Snapshot Viewer Use

Furkan Caliskan (@caliskanfurkan_)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ditsnap.yml

Windows: Application Allowlisting Bypass via Dnx.exe

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dnx.yml

Windows: Suspicious Double File Extension

Florian Roth (rule), @blu3_team (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_double_extension.yml

Windows: Application Allowlisting Bypass via Dxcap.exe

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_dxcap.yml

Windows: Suspicious Eventlog Clear or Configuration Using Wevtutil or Powershell or Wmic

Ecco, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_eventlog_clear.yml

Windows: Executables Started in Suspicious Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_exec_folder.yml

Windows: Execution in Non-Executable Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_execution_path.yml

Windows: Execution in Webserver Root Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_execution_path_webserver.yml

Windows: Explorer Root Flag Process Tree Break

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_explorer_break_proctree.yml

Windows: Suspicious File Characteristics Due to Missing Fields

Markus Neis, Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_file_characteristics.yml

Windows: Findstr Launching lnk File

Trent Liffick

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_findstr_lnk.yml

Windows: Firewall Disabled via Netsh

Fatih Sirin

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_firewall_disable.yml

Windows: Fsutil Suspicious Invocation

Ecco, E.M. Anhaus, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_fsutil_usage.yml

Windows: Suspicious GUP.exe Usage

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_gup.yml

Windows: IIS Native-Code Module Command Line Installation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_iss_module_install.yml

Windows: Windows Defender Download Activity

Matthew Matchen

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_mpcmdrun_download.yml

Windows: Suspicious MsiExec Directory

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msiexec_cwd.yml

Windows: MsiExec Web Install

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msiexec_web_install.yml

Windows: Malicious Payload Download via Office Binaries

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_msoffice.yml

Windows: Net.exe Execution For Discovery

Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_net_execution.yml

Windows: Suspicious Netsh.DLL Persistence

Victor Sergeev, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_netsh_dll_persistence.yml

Windows: Invocation of Active Directory Diagnostic Tool ntdsutil exe

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ntdsutil.yml

Windows: Application Allowlisting Bypass via DLL Loaded by odbcconf exe

Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_odbcconf.yml

Windows: OpenWith.exe Executing Specified Binary

Beyu Denis, oscd.community (rule), @harr0ey (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_openwith.yml

Windows: Suspicious Execution from Outlook

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_outlook.yml

Windows: Execution in Outlook Temp Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_outlook_temp.yml

Windows: Ping Hex IP

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ping_hex_ip.yml

Windows: Empire PowerShell Launch Parameters

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_empire_launch.yml

Windows: Empire PowerShell UAC Bypass

Ecco

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_empire_uac_bypass.yml

Windows: Suspicious Encoded PowerShell Command Line

Florian Roth, Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml

Windows: PowerShell Encoded Character Syntax

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_encoded_param.yml

Windows: Malicious Base64 Encoded PowerShell Keywords in Command Lines

John Lambert (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_hidden_b64_cmd.yml

Windows: Suspicious PowerShell Invocation Based on Parent Process

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_parent_combo.yml

Windows: Suspicious PowerShell Parent Process

Teymur Kheirkhabarov, Harish Segar (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_parent_process.yml

Windows: Suspicious Use of Procdump

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_procdump.yml

Windows: Programs starting from Suspicious Location

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_prog_location_process_starts.yml

Windows: PowerShell Script Run in AppData

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ps_appdata.yml

Windows: PowerShell DownloadFile

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_ps_downloadfile.yml

Windows: Psr.exe Capture Screenshots

Beyu Denis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_psr_capture_screenshots.yml

Windows: Rar with Password or Compression Level

@ROxPinTeddy

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rar_flags.yml

Windows: Suspicious RASdial Activity

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rasdial_activity.yml

Windows: Suspicious Reconnaissance Activity via net group or localgroup

Florian Roth, omkar72

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_recon_activity.yml

Windows: Suspicious Regsvr32 Usage

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_regsvr32_anomalies.yml

Windows: Regsvr32 Flags Anomaly

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_regsvr32_flags_anomaly.yml

Windows: Renamed ZOHO Dctask64

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_renamed_dctask64.yml

Windows: Renamed SysInternals Debug View

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_renamed_debugview.yml

Windows: Suspicious Process Start Locations

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_run_locations.yml

Windows: Suspicious Arguments in Rundll32 Usage

juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rundll32_activity.yml

Windows: Suspicious DLL Call by Ordinal

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml

Windows: Scheduled Task Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml

Windows: WSF JSE JS VBA VBE File Execution

Michael Haag

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_script_execution.yml

Windows: Suspicious Service Path Modification

Victor Sergeev, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_service_path_modification.yml

Windows: Squirrel Lolbin

Karneades / Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_squirrel_lolbin.yml

Windows: Suspicious Svchost Process

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_svchost.yml

Windows: Suspect Svchost Activity

David Burkett

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_svchost_no_cli.yml

Windows: Sysprep on AppData Folder

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_sysprep_appdata.yml

Windows: Suspicious SYSVOL Domain Group Policy Access

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_sysvol_access.yml

Windows: Taskmgr Created By Local SYSTEM Account

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_taskmgr_localsystem.yml

Windows: Process Launch from Taskmgr

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_taskmgr_parent.yml

Windows: Suspicious tscon.exe Created By Local SYSTEM Account

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_tscon_localsystem.yml

Windows: Suspicious RDP Redirect Using tscon.exe

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml

Windows: Suspicious Use of CSharp Interactive Console

Michael R. (@nahamike01)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_use_of_csharp_console.yml

Windows: Suspicious Userinit Child Process

Florian Roth (rule), Samir Bousseaden (idea)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_userinit_child.yml

Windows: Whoami Execution

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_whoami.yml

Windows: Suspicious WMI Execution

Michael Haag, Florian Roth, juju4

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml

Windows: Sysmon Driver Unload

Kirill Kiryanov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_sysmon_driver_unload.yml

Windows: System File Execution Location Anomaly

Florian Roth, Patrick Bareiss

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_system_exe_anomaly.yml

Windows: Tap Installer Execution

Daniil Yugoslavskiy, Ian Davis, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_tap_installer_execution.yml

Windows: Tasks Folder Evasion

Sreeman

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_task_folder_evasion.yml

Windows: Terminal Service Process Spawn

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_termserv_proc_spawn.yml

Windows: Domain Trust Discovery

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, omkar72

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_dsquery_domain_trust_discovery.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_trust_discovery.yml

Windows: Bypass UAC via CMSTP

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_cmstp.yml

Windows: Bypass UAC via Fodhelper.exe

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_fodhelper.yml

Windows: Bypass UAC via WSReset exe

E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_uac_wsreset.yml

Windows: Possible Privilege Escalation via Weak Service Permissions

Teymur Kheirkhabarov

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml

Windows: Java Running with Remote Debugging

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_vul_java_remote_debugging.yml

Windows: Webshell Detection With Command Line Keywords

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_detection.yml

Windows: Webshell Recon Detection Via CommandLine Processes

Cian Heasley

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_recon_detection.yml

Windows: Shells Spawned by Web Servers

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_webshell_spawn.yml

Windows: Run Whoami as SYSTEM

Teymur Kheirkhabarov

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_whoami_as_system.yml

Windows: Windows 10 Scheduled Task SandboxEscaper 0-day

Olaf Hartong

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_win10_sched_task_0day.yml

Windows: WMI Backdoor Exchange Transport Agent

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_backdoor_exchange_transport_agent.yml

Windows: WMI Persistence - Script Event Consumer

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_persistence_script_event_consumer.yml

Windows: WMI Spawning Windows PowerShell

Markus Neis / @Karneades

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmi_spwns_powershell.yml

Windows: Wmiprvse Spawning Process

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wmiprvse_spawning_process.yml

Windows: Microsoft Workflow Compiler

Nik Seetharaman

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_workflow_compiler.yml

Windows: Wsreset UAC Bypass

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_wsreset_uac_bypass.yml

Windows: XSL Script Processing

Timur Zinniatullin, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_xsl_script_processing.yml

Windows: Leviathan Registry Key Activity

Aidan Bracher

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_leviathan.yml

Windows: OceanLotus Registry Activity

megan201296

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_oceanlotus_registry.yml

Windows: Pandemic Registry Key

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_apt_pandemic.yml

Windows: Autorun Keys Modification

Victor Sergeev, Daniil Yugoslavskiy, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_asep_reg_keys_modification.yml

Windows: Suspicious New Printer Ports in Registry CVE-2020-1048

EagleEye Team, Florian Roth, NVISO

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_cve-2020-1048.yml

Windows: DHCP Callout DLL Installation

Dimitrios Slamaris

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_dhcp_calloutdll.yml

Windows: Disable Security Events Logging Adding Reg Key MiniNt

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_disable_security_events_logging_adding_reg_key_minint.yml

Windows: DNS ServerLevelPluginDll Install

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_dns_serverlevelplugindll.yml

Windows: COMPlus-ETWEnabled Registry Modification

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_etw_modification.yml ; https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_etw_disabled.yml

Windows: Windows Credential Editor Install Via Registry

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_hack_wce_reg.yml

Windows: Logon Scripts UserInitMprLogonScript Registry

Tom Ueltschi (@c_APT_ure)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_logon_scripts_userinitmprlogonscript_reg.yml

Windows: Narrator s Feedback-Hub Persistence

Dmitriy Lifanov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_narrator_feedback_persistance.yml

Windows: New DLL Added to AppCertDlls Registry Key

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_new_dll_added_to_appcertdlls_registry_key.yml

Windows: New DLL Added to AppInit-DLLs Registry Key

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_new_dll_added_to_appinit_dlls_registry_key.yml

Windows: Possible Privilege Escalation via Service Permissions Weakness

Teymur Kheirkhabarov

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_possible_privilege_escalation_via_service_registry_permissions_weakness.yml

Windows: RDP Registry Modification

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_rdp_registry_modification.yml

Windows: RDP Sensitive Settings Changed

Samir Bousseaden

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_rdp_settings_hijack.yml

Windows: RedMimicry Winnti Playbook Registry Manipulation

Alexander Rausch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_redmimicry_winnti_reg.yml

Windows: Office Security Settings Changed

Trent Liffick (@tliffick)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_reg_office_security.yml

Windows: Windows Registry Persistence COM Key Linking

Kutepov Anton, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_persistence_key_linking.yml

Windows: Windows Registry Persistence COM Search Order Hijacking

Maxime Thiebaut (@0xThiebaut)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_persistence_search_order.yml

Windows: Windows Registry Trust Record Modification

Antonlovesdnb

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_registry_trust_record_modification.yml

Windows: Security Support Provider SSP Added to LSA Configuration

iwillkeepwatch

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_ssp_added_lsa_config.yml

Windows: Sticky Key Like Backdoor Usage

Florian Roth, @twjackomo

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_stickykey_like_backdoor.yml

Windows: Suspicious RUN Key from Download

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_download_run_key.yml

Windows: DLL Load via LSASS

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_lsass_dll_load.yml

Windows: Suspicious Camera and Microphone Access

Den Iuzvyk

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_mic_cam_access.yml

Windows: Registry Persistence via Explorer Run Key

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_reg_persist_explorer_run.yml

Windows: New RUN Key Pointing to Suspicious Folder

Florian Roth, Markus Neis, Sander Wiebing

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_run_key_img_folder.yml

Windows: Suspicious Service Installed

xknow (@xknow_infosec), xorxes (@xor_xes)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_susp_service_installed.yml

Windows: Suspicious Keyboard Layout Load

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml

Windows: Usage of Sysinternals Tools

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_sysinternals_eula_accepted.yml

Windows: UAC Bypass via Event Viewer

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_uac_bypass_eventvwr.yml

Windows: UAC Bypass via Sdclt

Omer Yampel

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_uac_bypass_sdclt.yml

Windows: Registry Persistence Mechanisms

Karneades

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_win_reg_persistence.yml

Windows: Azure Browser SSO Abuse

Den Iuzvyk

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/sysmon_abusing_azure_browser_sso.yml

Windows: Executable in ADS

Florian Roth, @0xrawsec

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_ads_executable.yml

Windows: Alternate PowerShell Hosts Pipe

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_alternate_powershell_hosts_pipe.yml

Windows: Turla Group Named Pipes

Markus Neis

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_apt_turla_namedpipes.yml

Windows: CactusTorch Remote Thread Creation

@SBousseaden (detection), Thomas Patzke (rule)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cactustorch.yml

Windows: CMSTP Execution

Nik Seetharaman

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_cmstp_execution.yml

Windows: CobaltStrike Process Injection

Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cobaltstrike_process_injection.yml

Windows: CreateRemoteThread API and LoadLibrary

Roberto Rodriguez @Cyb3rWard0g

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_createremotethread_loadlibrary.yml

Windows: Cred Dump Tools Via Named Pipes

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_cred_dump_tools_named_pipes.yml

Windows: Malicious Named Pipe

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_mal_namedpipes.yml

Windows: Password Dumper Remote Thread in LSASS

Thomas Patzke

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_password_dumper_lsass.yml

Windows: Possible DNS Rebinding

Ilyas Ochkov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_possible_dns_rebinding.yml

Windows: Raw Disk Access Using Illegitimate Tools

Teymur Kheirkhabarov, oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_raw_disk_access_using_illegitimate_tools.yml

Windows: PowerShell Rundll32 Remote Thread Creation

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_susp_powershell_rundll32.yml

Windows: Suspicious Remote Thread Created

Perez Diego (@darkquassar), oscd.community

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_suspicious_remote_thread.yml

Windows: WMI Event Subscription

Tom Ueltschi (@c_APT_ure)

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_wmi_event_subscription.yml

Windows: Suspicious Scripting in a WMI Consumer

Florian Roth

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_wmi_susp_scripting.yml

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

User Guide

Public Domain Built-in Rules

Public Domain Built-in Rules

Public Domain Built-in Rules

Public Domain Built-in Rules