Static

static

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    aurora-agent-lite-win-pack.zip

  • Size

    27.4MB

  • MD5

    d71ae81640914dba66c1881efb351742

  • SHA1

    daa70b0d30521bddbe90c044e25151317100e648

  • SHA256

    84ff6af9cbc9689e387268b99b6dbd8f09130ee8ba83590948bf102cefaa1a9a

  • SHA512

    01aee906c115865b35e949515df60b1caec9db49bb1adb13e382de9aaa13324a0930711f1d3bea7b10a18cec55db85b15129b23a8268f99114c287cbd0b5fe9c

  • SSDEEP

    786432:g73cTIfxWygs8zvLaucZhU0mOh58/u0gNmGHiA1gGL6+:gfxHgs8zTShUnOf8/u0A/1gGL7

Score
1/10

Malware Config

Signatures

Files

  • aurora-agent-lite-win-pack.zip
    .zip
  • agent-config-intense.yml
  • agent-config-minimal.yml
  • agent-config-reduced.yml
  • agent-config-standard.yml
  • aurora-agent-64.exe
    .exe windows:6 windows x64 arch:x64

    4c1b85ee863a4ffbc440ab8858f357e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • aurora-agent-util.exe
    .exe windows:6 windows x86 arch:x86

    2e3fc10b187baa87504cfe460944e7ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • aurora-agent.exe
    .exe windows:6 windows x86 arch:x86

    38c8d89e3acba344f139278cbdd709ed


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • config/false-positives.cfg
  • config/process-excludes.cfg
  • custom-signatures/iocs/custom-c2-domains.txt.template
  • custom-signatures/iocs/custom-events.txt.template
  • custom-signatures/iocs/custom-filename-iocs.txt.template
  • custom-signatures/iocs/custom-hash-iocs.txt.template
  • custom-signatures/iocs/custom-mutexes.txt.template
  • custom-signatures/iocs/custom-namedpipes.txt.template
  • custom-signatures/sigma-rules/process-creation.yml.template
  • docs/Aurora_Lite_EULA.pdf
    .pdf
  • docs/aurora-agent-64.exe.sig
  • docs/aurora-agent-util.exe.sig
  • docs/aurora-agent.exe.sig
  • docs/changes.log
  • docs/licenses.csv
  • ioc-configs/ioc-config-intense.yml
  • ioc-configs/ioc-config-minimal.yml
  • ioc-configs/ioc-config-reduced.yml
  • ioc-configs/ioc-config-standard.yml
  • log-sources/etw-log-source-mappings.yml
  • log-sources/etw-log-sources-intense.yml
  • log-sources/etw-log-sources-minimal.yml
  • log-sources/etw-log-sources-reduced.yml
  • log-sources/etw-log-sources-standard.yml
  • log-sources/event-log-sources.yml
  • response-sets/aurora-lite.yml
  • response-sets/aurora-lite.yml.sig
  • signatures/changes.log
  • signatures/iocs/c2-iocs.dat
  • signatures/iocs/filename-iocs.dat
  • signatures/iocs/hash-iocs.dat
  • signatures/iocs/keywords.dat
  • signatures/iocs/otx-hash-iocs.dat
  • signatures/sigma-rules.sigs
  • signatures/sigma-rules/public/emerging-threats/2010/Exploits/CVE-2010-5278/web_cve_2010_5278_exploitation_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml
  • signatures/sigma-rules/public/emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_commands_critical.yml
  • signatures/sigma-rules/public/emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml
  • signatures/sigma-rules/public/emerging-threats/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Exploits/CVE-2017-0261/proc_creation_win_exploit_cve_2017_0261.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Exploits/CVE-2017-8759/proc_creation_win_exploit_cve_2017_8759.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/Fireball/proc_creation_win_malware_fireball.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/PlugX/proc_creation_win_malware_plugx_susp_exe_locations.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/StoneDrill/win_system_apt_stonedrill.yml
  • signatures/sigma-rules/public/emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/APT10/proc_creation_win_apt_apt10_cloud_hopper.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Lazarus/proc_creation_win_apt_lazarus_binary_masquerading.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Turla/pipe_created_apt_turla_named_pipes.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Turla/win_system_apt_carbonpaper_turla.yml
  • signatures/sigma-rules/public/emerging-threats/2017/TA/Turla/win_system_apt_turla_service_png.yml
  • signatures/sigma-rules/public/emerging-threats/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/APT27/proc_creation_win_apt_apt27_emissary_panda.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/APT28/proc_creation_win_apt_sofacy.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/APT29-CozyBear/file_event_win_apt_cozy_bear_phishing_campaign_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/APT29-CozyBear/proc_creation_win_apt_apt29_phishing_campaign_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/OilRig/proc_creation_win_apt_oilrig_mar18.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/OilRig/win_security_apt_oilrig_mar18.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/OilRig/win_system_apt_oilrig_mar18.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/Slingshot/proc_creation_win_apt_slingshot.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/Slingshot/win_security_apt_slingshot.yml
  • signatures/sigma-rules/public/emerging-threats/2018/TA/TropicTrooper/proc_creation_win_apt_tropictrooper.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/BearLPE-Exploit/proc_creation_win_exploit_other_bearlpe.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/CVE-2019-11510/web_cve_2019_11510_pulsesecure_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/CVE-2019-1378/proc_creation_win_exploit_cve_2019_1378.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/CVE-2019-1388/proc_creation_win_exploit_cve_2019_1388.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Exploits/CVE-2019-3398/web_cve_2019_3398_confluence.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Chafer/proxy_malware_chafer_url_pattern.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Dridex/proc_creation_win_malware_dridex.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Emotet/proc_creation_win_malware_emotet.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/LockerGoga/proc_creation_win_malware_lockergoga_ransomware.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/QBot/proc_creation_win_malware_qbot.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Snatch/proc_creation_win_malware_snatch_ransomware.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_c2_url.yml
  • signatures/sigma-rules/public/emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/APC-C-12/proc_creation_win_apt_aptc12_bluemushroom.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/Bear-APT-Activity/proc_creation_win_apt_bear_activity_gtr19.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/EmpireMonkey/proc_creation_win_apt_empiremonkey.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/EquationGroup/proc_creation_win_apt_equationgroup_dll_u_load.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/MustangPanda/proc_creation_win_apt_mustangpanda.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml
  • signatures/sigma-rules/public/emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_exchange_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-10148/web_cve_2020_10148_solarwinds_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-1048/proc_creation_win_exploit_cve_2020_1048.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-1048/registry_set_exploit_cve_2020_1048_new_printer_port.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-14882/web_cve_2020_14882_weblogic_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-28188/web_cve_2020_28188_terramaster_rce_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-3452/web_cve_2020_3452_cisco_asa_ftd.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Exploits/CVE-2020-8193/web_cve_2020_8193_8195_citrix_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/ComRAT/proxy_malware_comrat_network_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/Ke3chang-TidePool/proc_creation_win_malware_ke3chang_tidepool.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/Maze/proc_creation_win_malware_maze_ransomware.yml
  • signatures/sigma-rules/public/emerging-threats/2020/Malware/Trickbot/proc_creation_win_malware_trickbot_wermgr.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/Evilnum/proc_creation_win_apt_evilnum_jul20.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/GALLIUM/proc_creation_win_apt_gallium_iocs.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/GALLIUM/win_dns_analytic_apt_gallium.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml
    .ps1
  • signatures/sigma-rules/public/emerging-threats/2020/TA/Lazarus/proc_creation_win_apt_lazarus_group_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_vbscript_pattern.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/SolarWinds-Supply-Chain/web_solarwinds_supernova_webshell.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/TAIDOOR-RAT/proc_creation_win_apt_taidoor.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/Winnti/proc_creation_win_apt_winnti_mal_hk_jan20.yml
  • signatures/sigma-rules/public/emerging-threats/2020/TA/Winnti/proc_creation_win_apt_winnti_pipemon.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-1675/av_printernightmare_cve_2021_34527.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-1675/file_event_win_cve_2021_1675_printspooler.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler_operational.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-1675/win_security_exploit_cve_2021_1675_printspooler_security.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-21978/web_cve_2021_21978_vmware_view_planner_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-22123/web_cve_2021_22123_fortinet_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26814/web_cve_2021_26814_wzuh_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26858/file_event_win_cve_2021_26858_msexchange.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-26858/web_cve_2021_26858_iis_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-27905/web_cve_2021_27905_apache_solr_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-28480/web_cve_2021_28480_exchange_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-33766/web_cve_2021_33766_msexchange_proxytoken.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-35211/proc_creation_win_exploit_cve_2021_35211_servu.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-40444/file_event_win_exploit_cve_2021_40444.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-41379/file_event_win_cve_2021_41379_msi_lpe.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-41379/proc_creation_win_exploit_cve_2021_41379.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-42237/web_cve_2021_42237_sitecore_report_ashx.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-42278/win_system_exploit_cve_2021_42278.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-42287/win_security_samaccountname_spoofing_cve_2021_42287.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-44077/file_event_win_cve_2021_44077_poc_default_files.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/RazerInstaller-LPE-Exploit/proc_creation_win_exploit_other_razorinstaller_lpe.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/SystemNightmare-Exploit/proc_creation_win_exploit_other_systemnightmare.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/VisualDoor-Exploit/web_sonicwall_jarrewrite_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Exploits/win_exchange_cve_2021_42321.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml
    .ps1
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_7zip.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_commands.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/DarkSide/proc_creation_win_malware_darkside_ransomware.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Devil-Bait/file_event_win_malware_devil_bait_script_drop.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Devil-Bait/proxy_malware_devil_bait_c2_communication.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/FoggyWeb/image_load_malware_foggyweb_nobelium.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Goofy-Guineapig/file_event_win_malware_goofy_guineapig_file_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_googleupdate_uncommon_child_instance.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Goofy-Guineapig/proxy_malware_goofy_gunieapig_c2_communication.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Goofy-Guineapig/win_system_malware_goofy_guineapig_service_persistence.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Moriya-Rootkit/file_event_win_moriya_rootkit.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Pingback/file_event_win_malware_pingback_backdoor.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Pingback/image_load_malware_pingback_backdoor.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Pingback/proc_creation_win_malware_pingback_backdoor.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Small-Sieve/file_event_win_malware_small_sieve_evasion_typo.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Small-Sieve/proc_creation_win_malware_small_sieve_cli_arg.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Small-Sieve/proxy_malware_small_sieve_telegram_communication.yml
  • signatures/sigma-rules/public/emerging-threats/2021/Malware/Small-Sieve/registry_set_malware_small_sieve_evasion_typo.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/HAFNIUM/proc_creation_win_apt_hafnium.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/HAFNIUM/web_exchange_exploitation_hafnium.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/Kaseya-Supply-Chain/proc_creation_win_apt_revil_kaseya.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/PRIVATELOG/image_load_usp_svchost_clfsw32.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/SOURGUM/proc_creation_win_apt_sourgrum.yml
  • signatures/sigma-rules/public/emerging-threats/2021/TA/UNC2546/web_unc2546_dewmode_php_webshell.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-21554/proc_creation_win_exploit_cve_2023_21554_queuejumper.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-24527/file_event_win_cve_2022_24527_lpe.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-30190/registry_set_exploit_cve_2022_30190_msdt_follina.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-31656/web_cve_2022_31656_auth_bypass.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-31659/web_cve_2022_31659_vmware_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_exploitation.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_poc_exploitation.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_poc_exploitation.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-41120/proc_creation_win_exploit_cve_2022_41120_sysmon_eop.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Malware/BlueSky-Ransomware/win_security_malware_bluesky_ransomware_files_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Malware/Bumblebee/create_remote_thread_win_malware_bumblebee.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Malware/Hermetic-Wiper/proc_creation_win_malware_hermetic_wiper_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_single_dot_ending_file.yml
  • signatures/sigma-rules/public/emerging-threats/2022/Malware/win_mssql_sp_maggie.yml
  • signatures/sigma-rules/public/emerging-threats/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml
  • signatures/sigma-rules/public/emerging-threats/2022/TA/MERCURY/proc_creation_win_apt_mercury.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-2283/lnx_sshd_exploit_cve_2023_2283_libssh_authentication_bypass.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-23752/web_cve_2023_23752_joomla_exploit_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-27997/web_cve_2023_27997_pre_authentication_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_report_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_traffic.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_url_marker_traffic.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-36884/win_security_exploit_cve_2023_36884_office_windows_html_rce_share_access_pattern.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-38831/file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-38831/proc_creation_win_exploit_cve_2023_38831_winrar_child_proc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-40477/file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-43261/proxy_exploit_cve_2023_43261_milesight_information_disclosure.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-46747/proxy_cve_2023_46747_f5_remote_code_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Exploits/win_msmq_corrupted_packet.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_renamed_cmd.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_service_dll_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/image_load_malware_coldsteel_persistence_service_dll.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_anonymous_process.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_cleanup.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_service_persistence.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/registry_set_malware_coldsteel_created_users.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/COLDSTEEL/win_system_malware_coldsteel_persistence_service.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_net_user_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Griffon/proc_creation_win_malware_griffon_patterns.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/IcedID/proc_creation_win_malware_icedid_rundll32_dllregisterserver.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_regsvr32_calc_pattern.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_fake_dll_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_uninstaller_cleanup.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Rhadamanthys/proc_creation_win_malware_rhadamanthys_stealer_dll_launch.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/Rorschach/proc_creation_win_malware_rorschach_ransomware_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_encrypted_payload_ioc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_installers_ioc.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_exec.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_service_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/registry_event_malware_snake_covert_store_key.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/registry_set_malware_snake_encrypted_key.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/SNAKE/win_system_malware_snake_persistence_service.yml
  • signatures/sigma-rules/public/emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/dns_query_win_malware_3cx_compromise.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/image_load_malware_3cx_compromise_susp_dll.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/net_connection_win_malware_3cx_compromise_beaconing_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_children.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_update.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_c2_beacon_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Cozy-Bear/image_load_apt_cozy_bear_graphical_proton_dlls.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Cozy-Bear/win_taskscheduler_apt_cozy_bear_graphical_proton_task_names.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/dns_query_win_apt_diamond_steel_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/file_event_win_apt_diamond_sleet_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/image_load_apt_diamond_sleet_side_load.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/proc_creation_win_apt_diamond_sleet_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/registry_event_apt_diamond_sleet_scheduled_task.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/EquationGroup/net_dns_apt_equation_group_triangulation_c2_coms.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/EquationGroup/proxy_apt_equation_group_triangulation_c2_coms.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/FIN7/file_event_win_apt_fin7_powershell_scripts_naming_convention.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powerhold.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powertrash_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/FIN7/proc_creation_win_apt_fin7_powertrash_lateral_movement.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lace-Tempest/file_event_win_apt_lace_tempest_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_eraser_script.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_malware_launcher.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_cobalt_strike_download.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_loader_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_aspera_faspex_susp_child_process.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_manage_engine_susp_child_process.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Mustang-Panda-Australia-Campaign/proc_creation_win_apt_mustang_panda_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Onyx-Sleet/file_event_win_apt_onyx_sleet_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Peach-Sandstorm/proc_creation_win_apt_peach_sandstorm_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_exfil_mail_pattern.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_file_indicators.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_compressed_file_tmep_sh.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml
  • signatures/sigma-rules/public/emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_atp_unc4841_seaspy_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1212/web_exploit_cve_2024_1212_.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1708/file_event_win_exploit_cve_2024_1708_screenconnect.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1708/win_security_exploit_cve_2024_1708_screenconnect.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_lnk_lure_execution.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Malware/KamiKakaBot/registry_set_malware_kamikakabot_winlogon_persistence.yml
  • signatures/sigma-rules/public/emerging-threats/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml
  • signatures/sigma-rules/public/emerging-threats/2024/TA/DPRK/dns_query_win_apt_dprk_malicious_domains.yml
  • signatures/sigma-rules/public/emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml
  • signatures/sigma-rules/public/windows/builtin/application/Other/win_av_relevant_match.yml
  • signatures/sigma-rules/public/windows/builtin/application/application_error/win_application_msmpeng_crash_error.yml
  • signatures/sigma-rules/public/windows/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml
  • signatures/sigma-rules/public/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml
  • signatures/sigma-rules/public/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
  • signatures/sigma-rules/public/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml
  • signatures/sigma-rules/public/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml
  • signatures/sigma-rules/public/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml
  • signatures/sigma-rules/public/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml
  • signatures/sigma-rules/public/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml
  • signatures/sigma-rules/public/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml
  • signatures/sigma-rules/public/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml
  • signatures/sigma-rules/public/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml
  • signatures/sigma-rules/public/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml
  • signatures/sigma-rules/public/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml
  • signatures/sigma-rules/public/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml
  • signatures/sigma-rules/public/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml
  • signatures/sigma-rules/public/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_appx_package_installation.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_domains.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_package_locations.yml
  • signatures/sigma-rules/public/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml
  • signatures/sigma-rules/public/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml
  • signatures/sigma-rules/public/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml
  • signatures/sigma-rules/public/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml
  • signatures/sigma-rules/public/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml
  • signatures/sigma-rules/public/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml
  • signatures/sigma-rules/public/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml
  • signatures/sigma-rules/public/windows/builtin/dns_client/win_dns_client__mal_cobaltstrike.yml
  • signatures/sigma-rules/public/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml
  • signatures/sigma-rules/public/windows/builtin/dns_client/win_dns_client_mega_nz.yml
  • signatures/sigma-rules/public/windows/builtin/dns_client/win_dns_client_tor_onion.yml
  • signatures/sigma-rules/public/windows/builtin/dns_client/win_dns_client_ufile_io.yml
  • signatures/sigma-rules/public/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml
  • signatures/sigma-rules/public/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml
  • signatures/sigma-rules/public/windows/builtin/driverframeworks/win_usb_device_plugged.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_add_rule.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_reset_config.yml
  • signatures/sigma-rules/public/windows/builtin/firewall_as/win_firewall_as_setting_change.yml
  • signatures/sigma-rules/public/windows/builtin/ldap/win_ldap_recon.yml
  • signatures/sigma-rules/public/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_transportagent.yml
  • signatures/sigma-rules/public/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
  • signatures/sigma-rules/public/windows/builtin/ntlm/win_susp_ntlm_auth.yml
  • signatures/sigma-rules/public/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml
  • signatures/sigma-rules/public/windows/builtin/ntlm/win_susp_ntlm_rdp.yml
  • signatures/sigma-rules/public/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_access_token_abuse.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_admin_rdp_login.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_overpass_the_hash.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_rdp_bluekeep_poc_scanner.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_scrcons_remote_wmi_scripteventconsumer.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_susp_krbrelayup.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml
  • signatures/sigma-rules/public/windows/builtin/security/account_management/win_security_susp_wmi_login.yml
  • signatures/sigma-rules/public/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_account_discovery.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_ad_object_writedac_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_ad_replication_non_machine_account.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_ad_user_enumeration.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_add_remove_computer.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_admin_share_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_alert_active_directory_user_control.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_alert_ad_user_backdoors.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_alert_enable_weak_encryption.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_alert_ruler.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_atsvc_task.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_audit_log_cleared.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_camera_microphone_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_cobaltstrike_service_installs.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_codeintegrity_check_failure.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dcsync.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_device_installation_blocked.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_disable_event_auditing.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_disable_event_auditing_critical.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dot_net_etw_tamper.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_external_device.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_gpo_scheduledtasks.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_hidden_user_creation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_hktl_edr_silencer.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_hktl_nofilter.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_impacket_psexec.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_impacket_secretdump.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml
    .ps1
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml
    .ps1
  • signatures/sigma-rules/public/windows/builtin/security/win_security_iso_mount.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_lm_namedpipe.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_lsass_access_non_system_account.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_mal_creddumper.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_mal_service_installs.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_mal_wceaux_dll.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_metasploit_authentication.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_net_ntlm_downgrade.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_not_allowed_rdp_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_password_policy_enumerated.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_pcap_drivers.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_petitpotam_network_share.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_possible_dc_shadow.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_powershell_script_installed_as_service.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_protected_storage_service_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_rdp_reverse_tunnel.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_registry_permissions_weakness_check.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_remote_powershell_session.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_replay_attack_detected.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_scm_database_handle_failure.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_scm_database_privileged_operation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_service_install_remote_access_software.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_service_installation_by_unusal_client.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_add_domain_trust.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_add_sid_history.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_computer_name.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_dsrm_password_change.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_failed_logon_reasons.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_kerberos_manipulation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_ldap_dataexchange.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_local_anon_logon_created.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_lsass_dump.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_lsass_dump_generic.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_net_recon_activity.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_psexec.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_rc4_kerberos.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_scheduled_task_creation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_scheduled_task_update.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_sdelete.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_susp_time_modification.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_svcctl_remote_service.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_syskey_registry_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_tap_driver_installation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_user_added_to_local_administrators.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_user_creation.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_user_driver_loaded.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_user_logoff.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_windows_defender_exclusions_write_deleted.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_wmi_persistence.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml
  • signatures/sigma-rules/public/windows/builtin/security/win_security_workstation_was_locked.yml
  • signatures/sigma-rules/public/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml
  • signatures/sigma-rules/public/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml
  • signatures/sigma-rules/public/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml
  • signatures/sigma-rules/public/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml
  • signatures/sigma-rules/public/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml
  • signatures/sigma-rules/public/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml
  • signatures/sigma-rules/public/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_directory_services_sam/win_system_exploit_cve_2021_42287.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_rc4_downgrade.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_user_profiles_service/win_system_susp_vuln_cve_2022_21919_or_cve_2021_34484.yml
  • signatures/sigma-rules/public/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml
  • signatures/sigma-rules/public/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml
  • signatures/sigma-rules/public/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml
  • signatures/sigma-rules/public/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml
    .ps1
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml
    .ps1
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml
    .ps1
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_install_uncommon.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml
  • signatures/sigma-rules/public/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml
  • signatures/sigma-rules/public/windows/builtin/system/termdd/win_system_rdp_potential_cve_2019_0708.yml
  • signatures/sigma-rules/public/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml
  • signatures/sigma-rules/public/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml
  • signatures/sigma-rules/public/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml
  • signatures/sigma-rules/public/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml
  • signatures/sigma-rules/public/windows/builtin/win_alert_mimikatz_keywords.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_asr_lsass_access.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_history_delete.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_real_time_protection_errors.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_restored_quarantine_file.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_threat.yml
  • signatures/sigma-rules/public/windows/builtin/windefend/win_defender_virus_scan_disabled.yml
  • signatures/sigma-rules/public/windows/builtin/wmi/win_wmi_persistence.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_keepass.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml
  • signatures/sigma-rules/public/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_ads_executable.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml
  • signatures/sigma-rules/public/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_anonymfiles_com.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_appinstaller.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_cloudflared_communication.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_devtunnels_communication.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_mal_cobaltstrike.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_mega_nz.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_onelaunch_update_service.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_regsvr32_dns_query.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_tor_onion_domain_query.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_ufile_io_query.yml
  • signatures/sigma-rules/public/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_mal_drivers.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_mal_drivers_names.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_pua_process_hacker.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_pua_system_informer.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_susp_temp_use.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_vuln_drivers.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_vuln_drivers_names.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_vuln_hevd_driver.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_vuln_winring0_driver.yml
  • signatures/sigma-rules/public/windows/driver_load/driver_load_win_windivert.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_browser_credential_access.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_credential_manager_access.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_dpapi_master_key_access.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_reg_and_hive_access.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_susp_cred_hist_access.yml
  • signatures/sigma-rules/public/windows/file/file_access/file_access_win_susp_gpo_access_file.yml
  • signatures/sigma-rules/public/windows/file/file_change/file_change_win_2022_timestomping.yml
  • signatures/sigma-rules/public/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_cve_2021_1675_print_nightmare.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_backup_file.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_event_log_files.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_prefetch.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml
  • signatures/sigma-rules/public/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_access_susp_teams.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_access_susp_unattend_xml.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_advanced_ip_scanner.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_anydesk_artefact.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_aspnet_temp_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_bloodhound_collection.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_create_non_existent_dlls.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_creation_new_shim_database.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_creation_scr_binary_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_creation_system_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_csexec_service.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_csharp_compile_artefact.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_dump_file_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_errorhandler_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_exchange_webshell_drop.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_gotoopener_artefact.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_dumpert.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_nppspy.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_hktl_safetykatz.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_iso_file_mount.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_iso_file_recent.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_lsass_shtinkering.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_lsass_werfault_dump.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_mal_adwind.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_mal_octopus_scanner.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_msdt_susp_directories.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_net_cli_artefact.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_new_scr_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ntds_dit_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ntds_exfil_tools.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_addin_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_macro_files_created.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_outlook_newform.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_startup_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_susp_file_extension.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_pcre_net_temp_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_perflogs_susp_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_drop_powershell.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_module_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_rclone_config_files.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_remcom_service.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_ripzip_attack.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sam_dump.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sed_file_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_shell_write_susp_directory.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_startup_folder_file_write.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_colorcpl.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_desktop_ini.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_desktop_txt.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_diagcab.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_double_extension.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_executable_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_get_variable.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_pfx_file_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_powershell_profile.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_task_write.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_winsat.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_uac_bypass_wmp.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_webshell_creation_detect.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_winrm_awl_bypass.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_wmiexec_default_filename.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_wpbbin_persistence.yml
  • signatures/sigma-rules/public/windows/file/file_event/file_event_win_writing_local_admin_share.yml
  • signatures/sigma-rules/public/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml
  • signatures/sigma-rules/public/windows/file/file_rename/file_rename_win_ransomware.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_amsi_suspicious_process.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_credui_uncommon_process_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_system_management_automation_susp_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_tttracer_module_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_vss_ps_susp_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_vssapi_susp_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_dll_vsstrace_susp_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_hktl_sharpevtmute.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_hktl_silenttrinity_stager.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_lsass_unsigned_image_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_dotnet_clr_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_dotnet_gac_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_dsparse_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_excel_xll_susp_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_kerberos_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_outlook_outlvba_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_powershell_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_office_vbadll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_rundll32_remote_share_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_7za.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_antivirus.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_appverifui.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_avkkid.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_ccleaner_du.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_ccleaner_reactivator.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_chrome_frame_helper.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_classicexplorer32.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_comctl32.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_coregen.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_dbgcore_dll.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_dbghelp_dll.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_eacore.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_edputil.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_from_non_system_location.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_goopdate.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_gup_libcurl.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_iviewers.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_jsschhlp.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_keyscrambler.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_libvlc.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_mfdetours.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_mfdetours_unsigned.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_non_existent_dlls.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_office_dlls.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_rcdll.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_rjvplatform_default_location.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_robform.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_shell_chrome_api.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_shelldispatch.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_smadhook.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_solidpdfcreator.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_third_party.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_ualapi.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_vivaldi_elf.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_vmguestlib.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_vmware_xfer.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_waveedit.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_wazuh.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_windows_defender.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_side_load_wwlib.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_spoolsv_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_susp_dll_load_system_process.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_susp_python_image_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_susp_unsigned_dll.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_thor_unsigned_execution.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_uac_bypass_iscsicpl.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_uac_bypass_via_dism.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml
  • signatures/sigma-rules/public/windows/image_load/image_load_wsman_provider_image_load.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_addinutil.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_certutil_initiated_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_domain_mega_nz.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_domain_ngrok.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_eqnedt.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_imewdbld.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_msiexec_http.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_notepad.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_notion_api_susp_communication.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_office_uncommon_ports.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_python.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_rdp_to_http.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_regsvr32_network_activity.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_rundll32_net_connections.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_script.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_script_wan.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_cmstp.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_crypto_mining_pools.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_dead_drop_resolvers.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_devtunnel_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_dropbox_api.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_external_ip_lookup.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_google_api_non_browser_access.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_malware_callback_port.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_prog_location_network_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_telegram_api_non_browser_access.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_vscode_tunnel_connection.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_winlogon_net_connections.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml
  • signatures/sigma-rules/public/windows/network_connection/net_connection_win_wuauclt_network_connection.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_coercedpotato.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_efspotato.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_powershell_execution_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml
  • signatures/sigma-rules/public/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_powercat.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_susp_download.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_classic/posh_pc_xor_commandline.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_decompress_commands.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_get_clipboard.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_download.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_automated_collection.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_cor_profiler.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_create_local_user.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_directorysearcher.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_download_com_cradles.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_export_certificate.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_acl_service.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_adgroup.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_keylogging.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_localuser.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_msxml_com.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml
    .vbs
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_psasyncshell.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_psattack.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_set_acl.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_software_discovery.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_download.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_extracting.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_get_process.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_keywords.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_start_process.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml
    .ps1
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_test_netconnection.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_timestomp.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_wmimplant.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_x509enrollment.yml
  • signatures/sigma-rules/public/windows/powershell/powershell_script/posh_ps_xml_iex.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_cmstp_execution_by_access.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_hktl_generic_access.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_hktl_sysmonente.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_memdump.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_python_based_tool.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_seclogon_access.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_werfault.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_susp_invoke_patchingapi.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_susp_shellcode_injection.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_svchost_credential_dumping.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_svchost_susp_access_request.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml
  • signatures/sigma-rules/public/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_7zip_password_compression.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_7zip_password_extraction.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_adplus_memory_dump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_at_interactive_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_attrib_hiding_files.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_attrib_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bash_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bash_file_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_browsers_tor_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certoc_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certoc_load_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_decode.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_encode.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_export_pfx.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_clip_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_copy_dmp_from_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_del_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_http_appdata.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_path_traversal.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmdkey_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_conhost_legacy_option.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_conhost_path_traversal.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_control_panel_item.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_csc_susp_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_csi_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_csvde_export.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_insecure_connection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_insecure_porxy_or_doh.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_local_file_read.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_curl_susp_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dirlister_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dns_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_driverquery_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_driverquery_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dsacls_password_spray.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dsim_remove.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dumpminitool_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_esentutl_params.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_esentutl_webcache.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_expand_cabinet_files.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_explorer_lolbin_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_lnk.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_lsass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_finger_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_fsutil_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_git_susp_clone.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gpg4win_decryption.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gpg4win_encryption.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gpresult_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gup_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hh_chm_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hh_chm_remote_download_or_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hh_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_adcspwn.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_certify.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_certipy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_covenant.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_createminidump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_dinjector.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_dumpert.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_gmer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_handlekatz.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_hashcat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_hydra.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_impersonate.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_inveigh.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_koadic.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_krbrelay.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_localpotato.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_pchunter.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_powertool.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_pypykatz.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_rubeus.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_safetykatz.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpersist.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpmove.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sharpview.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_uacme.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_wce.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_winpeas.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_winpwn.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_xordump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hktl_zipexec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hostname_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hwp_exploits.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_icacls_deny.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ieexec_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_imewbdld_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_installutil_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_remote_debugging.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_kd_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ldifde_export.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ldifde_file_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_cdb.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_class_exec_xwizard.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_cmdl32.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_configsecuritypolicy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dctask64_proc_inject.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dll_sideload_xwizard.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dnx.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dotnet.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dotnet_dump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_dump64.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_extexport.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_format.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_fsharp_interpreters.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_ftp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_ilasm.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_jsc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_kavremover.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_msdt_answer_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_openconsole.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_openwith.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pcalua.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pester.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pester_1.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_printbrm.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_pubprn.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_register_app.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_remote.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_replace.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_setres.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_sftp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_sideload_link_binary.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_sigverif.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_ssh.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_certreq_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_tracker.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_type.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_wfc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolbin_workflow_compiler.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lolscript_register_app.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_lsass_process_clone.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mftrace_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mode_codepage_russian.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mofcomp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mpcmdrun_dll_sideload_defender.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msdt_susp_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msedge_proxy_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_http.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_javascript.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_embedding.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_install_remote.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_masquerading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msiexec_web_install.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msohtmed_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mspub_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msra_process_injection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msxsl_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_share_unmount.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_start_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_stop_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_use_mount_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_user_add.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_disable.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_packet_capture.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_nltest_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_nltest_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_node_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ntdsutil_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_response_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_office_winword_dll_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_php_inline_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ping_hex_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pktmon_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_plink_port_forwarding.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powercfg_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_audio_capture.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_iex.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_create_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_cradles.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_iex.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_email_exfil.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_encode.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_export_certificate.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_frombase64string.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_public_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_sam_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_service_dacl_modification_set_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_set_acl.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_stop_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_susp_ps_downloadfile.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_powershell_zip_compress.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_presentationhost_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_print_remote_file_copy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_protocolhandler_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_advancedrun.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_chisel.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_cleanwipe.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_crassus.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_csexec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_defendercheck.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_ditsnap.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_frp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_iox.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_netcat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_ngrok.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nimgrab.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nircmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nps.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_nsudo.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_pingcastle.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_process_hacker.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_radmin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_rclone_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_runxcmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_seatbelt.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_system_informer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_python_adidnsdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_python_pty_spawn.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_query_session_exfil.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rar_compress_data.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rar_compression_with_password.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rasdial_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_add_run_key.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_add_safeboot.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_bitlocker.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_delete_services.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_machineguid.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_nolmhash.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_open_command.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_query_registry.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_screensaver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_software_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_susp_paths.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regedit_export_keys.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regedit_import_keys.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regini_ads.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regini_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_install_reg_debugger_backdoor.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_logon_script.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_new_network_provider.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_remote_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_2.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_access_tools_ultraviewer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_remote_time_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_adfind.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_autohotkey.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_autoit.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_binary.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_browsercore.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_cloudflared.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_createdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_curl.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_dctask64.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_ftp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_gpg4win.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_jusched.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_mavinject.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_megasync.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_msdt.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_nircmd.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_office_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_paexec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_pingcastle.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_plink.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_pressanykey.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_rurat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_vmnat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_renamed_whoami.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_keymgr.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_no_params.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_run_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_sys.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_unc_path.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_runonce_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_create_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_disable_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_sdset_modification.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_service_path_modification.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sc_stop_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_change.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_delete.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_delete_all.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_disable.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_env_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml
    .ps1
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_schtasks_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sdclt_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_secedit_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_servu_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_shutdown_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_shutdown_logoff.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_squirrel_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ssh_port_forward.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_16bit_application.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_appx_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_automated_collection.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_disable_raccine.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_double_extension.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_download_office_domain.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_electron_app_children.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_execution_path.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_file_characteristics.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_image_missing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_network_command.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_network_sniffing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_non_exe_image.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ntds.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_office_token_search.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_parents.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_priv_escalation_via_named_pipe.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_progname.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_service_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_service_dir.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_service_tamper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_sysnative.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_sysvol_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_userinit_child.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_susp_workfolders.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_procdump.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_psservice.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_sysprep_appdata.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_systeminfo_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_takeown_recursive_own.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tapinstall_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tar_compression.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tar_extraction.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_taskkill_sep.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tscon_localsystem.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ultravnc.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vaultcmd_list_creds.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_verclsid_runs_com.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_virtualbox_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_w32tm.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wab_unusual_parents.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wbadmin_delete_systemstatebackup.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webshell_chopper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webshell_hacking.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_webshell_tool_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_where_browser_data_recon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_all_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_output.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winget_add_custom_source.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_winzip_password_compression.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_process_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_group.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_product.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_service.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_recon_volume.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_remote_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_terminate_application.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wscript_cscript_dropper.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml
  • signatures/sigma-rules/public/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml
  • signatures/sigma-rules/public/windows/process_tampering/proc_tampering_susp_process_hollowing.yml
  • signatures/sigma-rules/public/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_malware_netwire.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_malware_ursnif.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_persistence_amsi_providers.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_persistence_com_key_linking.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_persistence_logon_scripts_userinitmprlogonscript.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_pua_sysinternals_execution_via_eula.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_pua_sysinternals_renamed_execution_via_eula.yml
  • signatures/sigma-rules/public/windows/registry/registry_add/registry_add_pua_sysinternals_susp_execution_via_eula.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml
  • signatures/sigma-rules/public/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_add_local_hidden_user.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_apt_leviathan.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_apt_oceanlotus_registry.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_apt_oilrig_mar18.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_apt_pandemic.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_hack_wce_reg.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_mal_azorult.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_office_test_regadd.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_office_trust_record_modification.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_portproxy_registry_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_runkey_winekey.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_runonce_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_susp_atbroker_change.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_susp_download_run_key.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml
  • signatures/sigma-rules/public/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_add_port_monitor.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_aedebug_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_amsi_com_hijack.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bginfo_custom_db.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_change_rdp_port.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_change_security_zones.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_chrome_extension.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_comhijack_sdclt.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_crashdump_disabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_defender_exclusions.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_desktop_background_change.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_administrative_share.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_defender_firewall.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_function_user.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_system_restore.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_uac_registry.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_windows_firewall.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disable_winevt_logging.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disallowrun_execution.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_fax_change_service_user.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_fax_dll_persistance.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_file_association_exefile.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hhctrl_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hidden_extention.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hide_file.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hide_function_user.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_ime_non_default_extension.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_mal_blue_mockingbird.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_new_application_appcompat.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_new_network_provider.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_odbc_driver_registered.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_enable_dde.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_app_paths.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_chm.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_com_hijacking_susp_locations.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_globalflags.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_ie.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_ifilter.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_mpnotify.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_mycomputer.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_natural_language.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_office_vsto.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_scrobj_dll.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_search_order.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_shim_database.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_typed_paths.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_persistence_xll.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_policies_associations_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_powershell_as_service.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_powershell_execution_policy.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_servicedll_hijack.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_services_etw_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_set_nopolicies_user.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_sip_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_sophos_av_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_special_accounts.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_printer_driver.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_service_installed.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_suspicious_env_variables.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_taskcache_entry.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_telemetry_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_terminal_server_tampering.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_timeproviders_dllname.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_treatas_persistence.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_turn_on_dev_features.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_vbs_payload_stored.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_windows_defender_tamper.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml
  • signatures/sigma-rules/public/windows/registry/registry_set/registry_set_winlogon_notify_key.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_config_modification.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_config_modification_error.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_config_modification_status.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_file_block_executable.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_file_block_shredding.yml
  • signatures/sigma-rules/public/windows/sysmon/sysmon_file_executable_detected.yml
  • signatures/sigma-rules/public/windows/wmi_event/sysmon_wmi_event_subscription.yml
  • signatures/sigma-rules/public/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml
  • signatures/sigma-rules/public/windows/wmi_event/sysmon_wmi_susp_scripting.yml
  • signatures/sigmarev
  • signatures/sigrev
  • tools/aurora-dashboard.exe
    .exe windows:6 windows x64 arch:x64

    f0ea7b7844bbc5bfa9bb32efdcea957c


    Code Sign

    Headers

    Imports

    Sections

  • tools/aurora-dashboard.exe.sig