{
"platform": "windows-sysmon",
"note": "Seed knowledge base. Detection references are representative of publicly available Sigma logic (SigmaHQ) and should be validated against your deployed ruleset. Telemetry assumes a Windows host with Sysmon (and/or the Security event log with command-line + module auditing) emitting process, network, registry, and file events.",
"entries": [
{
"id": "whoami",
"match": { "program": "whoami" },
"description": "Current user discovery",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["Sysmon EID 1 (Process Create): whoami.exe", "Security 4688 with command line"],
"detections": [{ "source": "Sigma", "rule": "Whoami utility execution (proc_creation_win)", "confidence": "medium" }],
"noise": 40
},
{
"id": "whoami-priv",
"match": { "program": "whoami", "args": { "contains": "/priv" } },
"description": "Privilege enumeration via whoami /priv",
"techniques": [{ "id": "T1033", "name": "System Owner/User Discovery" }],
"telemetry": ["Sysmon EID 1: whoami.exe /priv"],
"detections": [{ "source": "Sigma", "rule": "Whoami privilege enumeration (proc_creation_win)", "confidence": "high" }],
"noise": 52
},
{
"id": "systeminfo",
"match": { "program": "systeminfo" },
"description": "System information / patch-level discovery",
"techniques": [{ "id": "T1082", "name": "System Information Discovery" }],
"telemetry": ["Sysmon EID 1: systeminfo.exe"],
"detections": [{ "source": "Sigma", "rule": "systeminfo execution (proc_creation_win)", "confidence": "low" }],
"noise": 35
},
{
"id": "ipconfig",
"match": { "program": "ipconfig" },
"description": "Network configuration discovery",
"techniques": [{ "id": "T1016", "name": "System Network Configuration Discovery" }],
"telemetry": ["Sysmon EID 1: ipconfig.exe"],
"detections": [{ "source": "Sigma", "rule": "Network configuration discovery (proc_creation_win)", "confidence": "low" }],
"noise": 30
},
{
"id": "netstat",
"match": { "program": "netstat" },
"description": "Network connection discovery",
"techniques": [{ "id": "T1049", "name": "System Network Connections Discovery" }],
"telemetry": ["Sysmon EID 1: netstat.exe -ano"],
"detections": [{ "source": "Sigma", "rule": "Network connection discovery (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "arp",
"match": { "program": "arp" },
"description": "ARP cache enumeration — adjacent host discovery",
"techniques": [{ "id": "T1018", "name": "Remote System Discovery" }],
"telemetry": ["Sysmon EID 1: arp.exe -a"],
"detections": [{ "source": "Sigma", "rule": "Remote system discovery (proc_creation_win)", "confidence": "low" }],
"noise": 38
},
{
"id": "tasklist",
"match": { "program": "tasklist" },
"description": "Running process discovery",
"techniques": [{ "id": "T1057", "name": "Process Discovery" }],
"telemetry": ["Sysmon EID 1: tasklist.exe"],
"detections": [{ "source": "Sigma", "rule": "Process discovery via tasklist (proc_creation_win)", "confidence": "low" }],
"noise": 35
},
{
"id": "net-user",
"match": { "program": { "any": ["net", "net1"] }, "args": { "at": { "index": 0, "value": { "eq": "user" } } } },
"description": "Local/domain account enumeration via net user",
"techniques": [{ "id": "T1087.001", "name": "Account Discovery: Local Account" }],
"telemetry": ["Sysmon EID 1: net.exe user (often via net1.exe child)"],
"detections": [{ "source": "Sigma", "rule": "Account discovery via net (proc_creation_win)", "confidence": "medium" }],
"noise": 45
},
{
"id": "net-localgroup",
"match": { "program": { "any": ["net", "net1"] }, "args": { "all": [{ "at": { "index": 0, "value": { "eq": "localgroup" } } }, { "not": { "flag": "/add" } }, { "not": { "flag": "/delete" } }] } },
"description": "Local group enumeration via net localgroup — group discovery",
"techniques": [{ "id": "T1069.001", "name": "Permission Groups Discovery: Local Groups" }],
"telemetry": ["Sysmon EID 1: net.exe localgroup (often via net1.exe child)"],
"detections": [{ "source": "Sigma", "rule": "Local group discovery via net (proc_creation_win)", "confidence": "medium" }],
"noise": 42
},
{
"id": "net-account-create",
"match": { "line": { "contains": "user /add" } },
"description": "Local account creation via net user /add — persistence",
"techniques": [{ "id": "T1136.001", "name": "Create Account: Local Account" }],
"telemetry": ["Sysmon EID 1: net.exe user /add", "Security 4720 (user account created)"],
"detections": [{ "source": "Sigma", "rule": "Local account creation via net (proc_creation_win)", "confidence": "high" }],
"noise": 70
},
{
"id": "net-localgroup-admin",
"match": { "line": { "contains": "localgroup administrators" } },
"description": "Adding a user to the local Administrators group — privilege escalation",
"techniques": [{ "id": "T1098", "name": "Account Manipulation" }],
"telemetry": ["Sysmon EID 1: net.exe localgroup administrators ... /add", "Security 4732 (member added to security-enabled local group)"],
"detections": [{ "source": "Sigma", "rule": "Local admin group modification (proc_creation_win)", "confidence": "high" }],
"noise": 68
},
{
"id": "domain-discovery",
"match": { "line": { "contains": "/domain" } },
"description": "Domain account/group enumeration (net group /domain, etc.)",
"techniques": [{ "id": "T1087.002", "name": "Account Discovery: Domain Account" }],
"telemetry": ["Sysmon EID 1 with /domain argument", "LDAP queries to a domain controller"],
"detections": [{ "source": "Sigma", "rule": "Domain account discovery (proc_creation_win)", "confidence": "medium" }],
"noise": 48
},
{
"id": "nltest-trusts",
"match": { "line": { "contains": "/domain_trusts" } },
"description": "Domain trust enumeration via nltest",
"techniques": [{ "id": "T1482", "name": "Domain Trust Discovery" }],
"telemetry": ["Sysmon EID 1: nltest.exe /domain_trusts"],
"detections": [{ "source": "Sigma", "rule": "Domain trust discovery via nltest (proc_creation_win)", "confidence": "high" }],
"noise": 55
},
{
"id": "net-share",
"match": { "line": { "contains": "net share" } },
"description": "Network share discovery",
"techniques": [{ "id": "T1135", "name": "Network Share Discovery" }],
"telemetry": ["Sysmon EID 1: net.exe share"],
"detections": [{ "source": "Sigma", "rule": "Network share discovery (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "reg-query",
"match": { "program": "reg", "args": { "contains": "query" } },
"description": "Registry query — configuration / autostart discovery",
"techniques": [{ "id": "T1012", "name": "Query Registry" }],
"telemetry": ["Sysmon EID 1: reg.exe query"],
"detections": [{ "source": "Sigma", "rule": "Registry query via reg.exe (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "run-key-persist",
"match": { "line": { "contains": "currentversion\\run" }, "event": { "class": "registry", "field": "TargetObject", "contains": "\\CurrentVersion\\Run" } },
"description": "Writing a Run key — registry autostart persistence",
"techniques": [{ "id": "T1547.001", "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder" }],
"telemetry": ["Sysmon EID 13 (Registry Set) under ...\\CurrentVersion\\Run"],
"detections": [{ "source": "Sigma", "rule": "Run key modification (registry_set_win)", "confidence": "high" }],
"noise": 65
},
{
"id": "schtasks-create",
"match": { "program": "schtasks", "args": { "contains": "/create" } },
"description": "Scheduled task creation — execution / persistence",
"techniques": [{ "id": "T1053.005", "name": "Scheduled Task/Job: Scheduled Task" }],
"telemetry": ["Sysmon EID 1: schtasks.exe /create", "Security 4698 (scheduled task created)"],
"detections": [{ "source": "Sigma", "rule": "Scheduled task creation (proc_creation_win)", "confidence": "high" }],
"noise": 62
},
{
"id": "service-create",
"match": { "program": "sc", "args": { "contains": "create" } },
"description": "Windows service creation — persistence / privilege",
"techniques": [{ "id": "T1543.003", "name": "Create or Modify System Process: Windows Service" }],
"telemetry": ["Sysmon EID 1: sc.exe create", "Security 7045 (service installed)"],
"detections": [{ "source": "Sigma", "rule": "Service creation via sc.exe (proc_creation_win)", "confidence": "high" }],
"noise": 62
},
{
"id": "powershell-encoded",
"match": { "program": "powershell", "args": { "contains": "-enc" } },
"description": "Encoded PowerShell command — obfuscated execution",
"techniques": [
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" },
{ "id": "T1027", "name": "Obfuscated Files or Information" }
],
"telemetry": ["Sysmon EID 1: powershell.exe -EncodedCommand", "PowerShell 4104 (scriptblock logging)"],
"detections": [{ "source": "Sigma", "rule": "Encoded PowerShell command (proc_creation_win)", "confidence": "high" }],
"noise": 75
},
{
"id": "powershell-hidden",
"match": { "line": { "all": [{ "any": [{ "contains": "powershell" }, { "contains": "pwsh" }] }, { "regex": "-w(?:indowstyle|indowstyl|indowsty|indowst|indows|indow|indo|ind|in|i)?\\s+(?:hidden|1)\\b" }] } },
"example": "powershell -w hidden -enc ZQBjAGgAbwA=",
"description": "Hidden-window PowerShell — defense evasion",
"techniques": [
{ "id": "T1564.003", "name": "Hide Artifacts: Hidden Window" },
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" }
],
"telemetry": ["Sysmon EID 1 with -WindowStyle Hidden / -w hidden"],
"detections": [{ "source": "Sigma", "rule": "Hidden window process execution (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "download-cradle",
"match": { "line": { "contains": "downloadstring" } },
"description": "PowerShell download cradle (Net.WebClient.DownloadString) — in-memory tool ingress",
"techniques": [
{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" },
{ "id": "T1105", "name": "Ingress Tool Transfer" }
],
"telemetry": ["Sysmon EID 1 + EID 3 (network) from powershell.exe", "PowerShell 4104 containing DownloadString"],
"detections": [{ "source": "Sigma", "rule": "PowerShell download cradle (ps_script / proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "download-file",
"match": { "line": { "contains": "downloadfile" } },
"description": "PowerShell DownloadFile — tool ingress to disk",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["Sysmon EID 1 + EID 3 from powershell.exe", "Sysmon EID 11 (File Create) of the downloaded payload"],
"detections": [{ "source": "Sigma", "rule": "PowerShell DownloadFile (ps_script)", "confidence": "high" }],
"noise": 72
},
{
"id": "invoke-expression",
"match": { "line": { "contains": "invoke-expression" } },
"description": "Invoke-Expression (IEX) — dynamic code execution",
"techniques": [{ "id": "T1059.001", "name": "Command and Scripting Interpreter: PowerShell" }],
"telemetry": ["PowerShell 4104 scriptblock containing Invoke-Expression"],
"detections": [{ "source": "Sigma", "rule": "Invoke-Expression usage (ps_script)", "confidence": "medium" }],
"noise": 65
},
{
"id": "certutil-download",
"match": { "program": "certutil", "args": { "contains": "urlcache" } },
"description": "certutil used to download a file — LOLBin tool ingress",
"techniques": [{ "id": "T1105", "name": "Ingress Tool Transfer" }],
"telemetry": ["Sysmon EID 1: certutil.exe -urlcache -f", "Sysmon EID 3 (network) from certutil.exe"],
"detections": [{ "source": "Sigma", "rule": "certutil file download (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "certutil-decode",
"match": { "program": "certutil", "args": { "contains": "decode" } },
"description": "certutil used to decode a payload — LOLBin deobfuscation",
"techniques": [
{ "id": "T1140", "name": "Deobfuscate/Decode Files or Information" },
{ "id": "T1027", "name": "Obfuscated Files or Information" }
],
"telemetry": ["Sysmon EID 1: certutil.exe -decode"],
"detections": [{ "source": "Sigma", "rule": "certutil decode (proc_creation_win)", "confidence": "medium" }],
"noise": 60
},
{
"id": "bitsadmin-transfer",
"match": { "program": "bitsadmin", "args": { "contains": "/transfer" } },
"description": "BITS job for file transfer — stealthy tool ingress",
"techniques": [{ "id": "T1197", "name": "BITS Jobs" }],
"telemetry": ["Sysmon EID 1: bitsadmin.exe /transfer", "BITS-Client operational log"],
"detections": [{ "source": "Sigma", "rule": "bitsadmin transfer (proc_creation_win)", "confidence": "medium" }],
"noise": 65
},
{
"id": "mshta-http",
"match": { "program": "mshta", "args": { "contains": "http" } },
"description": "mshta executing remote content — LOLBin proxy execution",
"techniques": [{ "id": "T1218.005", "name": "System Binary Proxy Execution: Mshta" }],
"telemetry": ["Sysmon EID 1: mshta.exe with a URL", "Sysmon EID 3 (network) from mshta.exe"],
"detections": [{ "source": "Sigma", "rule": "mshta remote execution (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "regsvr32-squiblydoo",
"match": { "line": { "contains": "scrobj.dll" } },
"description": "regsvr32 scrobj.dll (Squiblydoo) — LOLBin proxy execution",
"techniques": [{ "id": "T1218.010", "name": "System Binary Proxy Execution: Regsvr32" }],
"telemetry": ["Sysmon EID 1: regsvr32.exe /i:<url> scrobj.dll", "Sysmon EID 7 (Image Loaded) scrobj.dll"],
"detections": [{ "source": "Sigma", "rule": "Squiblydoo regsvr32 execution (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "wmic-process-create",
"match": { "program": "wmic", "args": { "joined": { "contains": "process call create" } } },
"description": "Process creation via WMI",
"techniques": [{ "id": "T1047", "name": "Windows Management Instrumentation" }],
"telemetry": ["Sysmon EID 1: wmic.exe process call create", "WMI-Activity operational log"],
"detections": [{ "source": "Sigma", "rule": "WMI process creation (proc_creation_win)", "confidence": "high" }],
"noise": 66
},
{
"id": "sam-hive-dump",
"match": { "line": { "contains": "hklm\\sam" } },
"description": "Dumping the SAM registry hive — credential access",
"techniques": [{ "id": "T1003.002", "name": "OS Credential Dumping: Security Account Manager" }],
"telemetry": ["Sysmon EID 1: reg.exe save HKLM\\SAM", "Sysmon EID 11 (File Create) of the exported hive"],
"detections": [{ "source": "Sigma", "rule": "SAM hive export via reg.exe (proc_creation_win)", "confidence": "high" }],
"noise": 82
},
{
"id": "ntds-dump",
"match": { "line": { "contains": "ntds.dit" } },
"description": "Access to NTDS.dit — domain credential database dumping",
"techniques": [{ "id": "T1003.003", "name": "OS Credential Dumping: NTDS" }],
"telemetry": ["Sysmon EID 1 referencing ntds.dit", "ntdsutil / vssadmin activity"],
"detections": [{ "source": "Sigma", "rule": "NTDS.dit access (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "lsass-comsvcs",
"match": { "line": { "contains": "comsvcs.dll" } },
"description": "LSASS memory dump via comsvcs.dll MiniDump — credential access",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) targeting lsass.exe", "Sysmon EID 1: rundll32 comsvcs.dll, MiniDump"],
"detections": [{ "source": "Sigma", "rule": "LSASS dump via comsvcs MiniDump (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "mimikatz",
"match": { "line": { "contains": "sekurlsa" } },
"description": "Mimikatz sekurlsa — credential material extraction",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) to lsass.exe with suspicious access mask"],
"detections": [{ "source": "Sigma", "rule": "Mimikatz sekurlsa indicators (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 85
},
{
"id": "procdump-lsass",
"match": { "program": "procdump", "args": { "contains": "lsass" } },
"description": "procdump against lsass — credential access",
"techniques": [{ "id": "T1003.001", "name": "OS Credential Dumping: LSASS Memory" }],
"telemetry": ["Sysmon EID 10 (Process Access) to lsass.exe", "Sysmon EID 11 (File Create) of the .dmp file"],
"detections": [{ "source": "Sigma", "rule": "procdump lsass dump (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "defender-disable",
"match": { "line": { "contains": "disablerealtimemonitoring" } },
"description": "Disabling Defender real-time monitoring — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["PowerShell 4104: Set-MpPreference -DisableRealtimeMonitoring $true"],
"detections": [{ "source": "Sigma", "rule": "Defender real-time protection disabled (ps_script)", "confidence": "high" }],
"noise": 78
},
{
"id": "defender-exclusion",
"match": { "line": { "contains": "-exclusionpath" } },
"description": "Adding a Defender exclusion path — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["PowerShell 4104: Add-MpPreference -ExclusionPath"],
"detections": [{ "source": "Sigma", "rule": "Defender exclusion added (ps_script)", "confidence": "high" }],
"noise": 70
},
{
"id": "netsh-firewall",
"match": { "line": { "contains": "advfirewall set" } },
"description": "Modifying the Windows firewall via netsh — defense impairment",
"techniques": [{ "id": "T1562.004", "name": "Impair Defenses: Disable or Modify System Firewall" }],
"telemetry": ["Sysmon EID 1: netsh.exe advfirewall set ... state off"],
"detections": [{ "source": "Sigma", "rule": "Firewall modification via netsh (proc_creation_win)", "confidence": "medium" }],
"noise": 64
},
{
"id": "clear-eventlog",
"match": { "program": "wevtutil", "args": { "contains": "cl" } },
"description": "Clearing a Windows event log — anti-forensics",
"techniques": [{ "id": "T1070.001", "name": "Indicator Removal: Clear Windows Event Logs" }],
"telemetry": ["Sysmon EID 1: wevtutil.exe cl", "Security 1102 (audit log cleared)"],
"detections": [{ "source": "Sigma", "rule": "Event log cleared via wevtutil (proc_creation_win)", "confidence": "high" }],
"noise": 76
},
{
"id": "clear-eventlog-ps",
"match": { "line": { "contains": "clear-eventlog" } },
"description": "Clearing event logs via PowerShell — anti-forensics",
"techniques": [{ "id": "T1070.001", "name": "Indicator Removal: Clear Windows Event Logs" }],
"telemetry": ["PowerShell 4104: Clear-EventLog", "Security 1102 (audit log cleared)"],
"detections": [{ "source": "Sigma", "rule": "Event log cleared via PowerShell (ps_script)", "confidence": "high" }],
"noise": 76
},
{
"id": "vssadmin-delete",
"match": { "program": "vssadmin", "args": { "joined": { "contains": "delete shadows" } } },
"description": "Deleting volume shadow copies — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: vssadmin.exe delete shadows"],
"detections": [{ "source": "Sigma", "rule": "Shadow copy deletion (proc_creation_win)", "confidence": "high" }],
"noise": 78
},
{
"id": "bcdedit-recovery",
"match": { "program": "bcdedit" },
"description": "Modifying boot configuration — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: bcdedit.exe /set ... recoveryenabled no"],
"detections": [{ "source": "Sigma", "rule": "Boot recovery tampering via bcdedit (proc_creation_win)", "confidence": "medium" }],
"noise": 60
},
{
"id": "attrib-hidden",
"match": { "program": "attrib", "args": { "contains": "+h" } },
"description": "Setting the hidden attribute — hide artifacts",
"techniques": [{ "id": "T1564.001", "name": "Hide Artifacts: Hidden Files and Directories" }],
"telemetry": ["Sysmon EID 1: attrib.exe +h"],
"detections": [{ "source": "Sigma", "rule": "Hidden file attribute set (proc_creation_win)", "confidence": "low" }],
"noise": 45
},
{
"id": "rundll32",
"match": { "program": "rundll32" },
"description": "rundll32 execution — common proxy-execution LOLBin",
"techniques": [{ "id": "T1218.011", "name": "System Binary Proxy Execution: Rundll32" }],
"telemetry": ["Sysmon EID 1: rundll32.exe", "Sysmon EID 7 (Image Loaded) of the target DLL"],
"detections": [{ "source": "Sigma", "rule": "Suspicious rundll32 execution (proc_creation_win)", "confidence": "low" }],
"noise": 50
},
{
"id": "setspn-kerberoast",
"match": { "program": "setspn", "args": { "contains": "-q" } },
"description": "SPN enumeration via setspn — Kerberoasting reconnaissance",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Sysmon EID 1: setspn.exe -q", "LDAP query for servicePrincipalName to a DC"],
"detections": [{ "source": "Sigma", "rule": "SPN enumeration via setspn (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "kerberoast-getuserspns",
"match": { "line": { "contains": "getuserspns" } },
"description": "Kerberoasting via GetUserSPNs (Impacket / PowerView)",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Kerberos TGS-REQ for service accounts with RC4 encryption", "Security 4769 (Kerberos service ticket requested)"],
"detections": [{ "source": "Sigma", "rule": "Kerberoasting via GetUserSPNs (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 74
},
{
"id": "kerberoast-invoke",
"match": { "line": { "contains": "invoke-kerberoast" } },
"description": "Kerberoasting via Invoke-Kerberoast",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["PowerShell 4104: Invoke-Kerberoast", "Security 4769 with RC4 ticket encryption"],
"detections": [{ "source": "Sigma", "rule": "Invoke-Kerberoast usage (ps_script)", "confidence": "high" }],
"noise": 76
},
{
"id": "rubeus",
"match": { "line": { "contains": "rubeus" } },
"description": "Rubeus — Kerberos ticket abuse (roasting, ptt, harvesting)",
"techniques": [{ "id": "T1558.003", "name": "Steal or Forge Kerberos Tickets: Kerberoasting" }],
"telemetry": ["Sysmon EID 1 / EID 10; anomalous Kerberos ticket requests (4769/4768)"],
"detections": [{ "source": "Sigma", "rule": "Rubeus indicators (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "asreproast",
"match": { "line": { "contains": "getnpusers" } },
"description": "AS-REP roasting via GetNPUsers (Impacket)",
"techniques": [{ "id": "T1558.004", "name": "Steal or Forge Kerberos Tickets: AS-REP Roasting" }],
"telemetry": ["Kerberos AS-REQ for accounts without pre-auth", "Security 4768 (TGT requested)"],
"detections": [{ "source": "Sigma", "rule": "AS-REP roasting via GetNPUsers (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 74
},
{
"id": "dcsync",
"match": { "line": { "contains": "dcsync" } },
"description": "DCSync — replicating directory secrets from a domain controller",
"techniques": [{ "id": "T1003.006", "name": "OS Credential Dumping: DCSync" }],
"telemetry": ["Security 4662 with DS-Replication-Get-Changes access from a non-DC", "replication (DRSUAPI) from an unexpected host"],
"detections": [{ "source": "Sigma", "rule": "DCSync replication request (proc_creation_win / security)", "confidence": "high" }],
"noise": 85
},
{
"id": "golden-ticket",
"match": { "line": { "contains": "kerberos::golden" } },
"description": "Golden/forged Kerberos ticket via mimikatz kerberos::golden",
"techniques": [{ "id": "T1558.001", "name": "Steal or Forge Kerberos Tickets: Golden Ticket" }],
"telemetry": ["TGTs with anomalous lifetime; 4768/4769 mismatches"],
"detections": [{ "source": "Sigma", "rule": "Mimikatz golden ticket indicators (proc_creation_win)", "confidence": "high" }],
"noise": 84
},
{
"id": "pass-the-hash",
"match": { "line": { "contains": "sekurlsa::pth" } },
"description": "Pass-the-Hash via mimikatz sekurlsa::pth",
"techniques": [{ "id": "T1550.002", "name": "Use Alternate Authentication Material: Pass the Hash" }],
"telemetry": ["Security 4624 type 9 (NewCredentials) logon", "Sysmon EID 10 access to lsass.exe"],
"detections": [{ "source": "Sigma", "rule": "Pass-the-hash via mimikatz (proc_creation_win)", "confidence": "high" }],
"noise": 82
},
{
"id": "lsadump",
"match": { "line": { "contains": "lsadump" } },
"description": "mimikatz lsadump — SAM / LSA secrets extraction",
"techniques": [{ "id": "T1003.004", "name": "OS Credential Dumping: LSA Secrets" }],
"telemetry": ["Registry access to SECURITY\\Policy\\Secrets", "Sysmon EID 10 to lsass.exe"],
"detections": [{ "source": "Sigma", "rule": "mimikatz lsadump indicators (proc_creation_win)", "confidence": "high" }],
"noise": 80
},
{
"id": "sharphound",
"match": { "line": { "contains": "sharphound" } },
"description": "BloodHound collection via SharpHound — AD relationship mapping",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }
],
"telemetry": ["heavy LDAP/SAMR enumeration to a DC", "Sysmon EID 3 to LDAP (389/636)"],
"detections": [{ "source": "Sigma", "rule": "SharpHound / BloodHound collection (proc_creation_win)", "confidence": "high" }],
"noise": 72
},
{
"id": "powerview",
"match": { "line": { "contains": "get-net" } },
"description": "PowerView domain enumeration (Get-Net* / Get-Domain*)",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }
],
"telemetry": ["PowerShell 4104 with PowerView cmdlets", "LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "PowerView domain enumeration (ps_script)", "confidence": "medium" }],
"noise": 62
},
{
"id": "adfind",
"match": { "program": "adfind" },
"description": "AdFind — Active Directory enumeration",
"techniques": [
{ "id": "T1087.002", "name": "Account Discovery: Domain Account" },
{ "id": "T1482", "name": "Domain Trust Discovery" }
],
"telemetry": ["Sysmon EID 1: adfind.exe", "broad LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "AdFind execution (proc_creation_win)", "confidence": "medium" }],
"noise": 64
},
{
"id": "dsquery",
"match": { "program": "dsquery" },
"description": "dsquery — directory object enumeration",
"techniques": [{ "id": "T1087.002", "name": "Account Discovery: Domain Account" }],
"telemetry": ["Sysmon EID 1: dsquery.exe", "LDAP queries to a DC"],
"detections": [{ "source": "Sigma", "rule": "dsquery enumeration (proc_creation_win)", "confidence": "low" }],
"noise": 52
},
{
"id": "domain-admins-enum",
"match": { "line": { "contains": "domain admins" } },
"description": "Enumerating the Domain Admins group — high-value target discovery",
"techniques": [{ "id": "T1069.002", "name": "Permission Groups Discovery: Domain Groups" }],
"telemetry": ["Sysmon EID 1: net group \"Domain Admins\" /domain", "LDAP query for the group's members"],
"detections": [{ "source": "Sigma", "rule": "Domain Admins enumeration (proc_creation_win)", "confidence": "medium" }],
"noise": 55
},
{
"id": "klist",
"match": { "program": "klist" },
"description": "Kerberos ticket cache listing",
"techniques": [{ "id": "T1550.003", "name": "Use Alternate Authentication Material: Pass the Ticket" }],
"telemetry": ["Sysmon EID 1: klist.exe"],
"detections": [{ "source": "Sigma", "rule": "Kerberos ticket listing via klist (proc_creation_win)", "confidence": "low" }],
"noise": 40
},
{
"id": "psexec",
"match": { "program": "psexec" },
"description": "PsExec — remote execution over SMB admin shares",
"techniques": [
{ "id": "T1021.002", "name": "Remote Services: SMB/Windows Admin Shares" },
{ "id": "T1569.002", "name": "System Services: Service Execution" }
],
"telemetry": ["Sysmon EID 1: psexec.exe / PSEXESVC service on the target", "Security 7045 (service installed) on target"],
"detections": [{ "source": "Sigma", "rule": "PsExec execution (proc_creation_win)", "confidence": "medium" }],
"noise": 70
},
{
"id": "impacket-exec",
"match": { "line": { "contains": "wmiexec" } },
"description": "Impacket wmiexec/smbexec-style remote execution",
"techniques": [
{ "id": "T1021.002", "name": "Remote Services: SMB/Windows Admin Shares" },
{ "id": "T1047", "name": "Windows Management Instrumentation" }
],
"telemetry": ["service/WMI-spawned cmd.exe with output redirected to a share (\\\\127.0.0.1\\ADMIN$)"],
"detections": [{ "source": "Sigma", "rule": "Impacket lateral movement (proc_creation_win)", "confidence": "high" }],
"noise": 74
},
{
"id": "winrm-remoting",
"match": { "line": { "contains": "invoke-command" } },
"description": "PowerShell remoting (Invoke-Command / Enter-PSSession) — lateral movement",
"techniques": [{ "id": "T1021.006", "name": "Remote Services: Windows Remote Management" }],
"telemetry": ["wsmprovhost.exe on the target", "Sysmon EID 3 to WinRM (5985/5986)"],
"detections": [{ "source": "Sigma", "rule": "PowerShell remoting execution (proc_creation_win)", "confidence": "medium" }],
"noise": 58
},
{
"id": "gpp-cpassword",
"match": { "line": { "contains": "cpassword" } },
"description": "Reading Group Policy Preferences cPassword — credentials in SYSVOL",
"techniques": [{ "id": "T1552.006", "name": "Unsecured Credentials: Group Policy Preferences" }],
"telemetry": ["read of Groups.xml under \\\\<domain>\\SYSVOL", "cPassword field access"],
"detections": [{ "source": "Sigma", "rule": "GPP cPassword access (proc_creation_win / ps_script)", "confidence": "high" }],
"noise": 72
},
{
"id": "runas-netonly",
"match": { "line": { "contains": "/netonly" } },
"description": "runas /netonly — using alternate credentials for network auth",
"techniques": [{ "id": "T1078", "name": "Valid Accounts" }],
"telemetry": ["Sysmon EID 1: runas.exe /netonly", "Security 4648 (explicit credential logon)"],
"detections": [{ "source": "Sigma", "rule": "runas /netonly usage (proc_creation_win)", "confidence": "medium" }],
"noise": 55
},
{
"id": "uac-bypass-fodhelper",
"match": { "line": { "contains": "fodhelper" } },
"description": "UAC bypass via fodhelper.exe auto-elevation",
"techniques": [{ "id": "T1548.002", "name": "Abuse Elevation Control Mechanism: Bypass User Account Control" }],
"telemetry": ["Sysmon EID 1: fodhelper.exe spawning an auto-elevated child", "Sysmon EID 13 (Registry Set) under HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command"],
"detections": [{ "source": "Sigma", "rule": "UAC bypass via fodhelper (proc_creation_win)", "confidence": "high" }],
"noise": 65
},
{
"id": "amsi-bypass",
"match": { "line": { "contains": "amsiinitfailed" } },
"description": "In-memory AMSI bypass via amsiInitFailed — defense impairment",
"techniques": [{ "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools" }],
"telemetry": ["PowerShell 4104: reflection patching AmsiUtils amsiInitFailed", "AMSI bypass performed before script execution"],
"detections": [{ "source": "Sigma", "rule": "AMSI bypass via amsiInitFailed (ps_script)", "confidence": "high" }],
"noise": 70
},
{
"id": "msiexec-remote",
"match": { "program": "msiexec", "args": { "contains": "http" } },
"description": "Installing an MSI from a URL via msiexec — LOLBin proxy execution",
"techniques": [{ "id": "T1218.007", "name": "System Binary Proxy Execution: Msiexec" }],
"telemetry": ["Sysmon EID 1: msiexec.exe installing a package from a URL", "Sysmon EID 3 (network): msiexec.exe outbound to a remote host"],
"detections": [{ "source": "Sigma", "rule": "Remote MSI install via msiexec (proc_creation_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "installutil",
"match": { "program": "installutil" },
"description": "Executing a .NET assembly via InstallUtil — LOLBin proxy execution",
"techniques": [{ "id": "T1218.004", "name": "System Binary Proxy Execution: InstallUtil" }],
"telemetry": ["Sysmon EID 1: installutil.exe running an assembly's install hook"],
"detections": [{ "source": "Sigma", "rule": "Proxy execution via InstallUtil (proc_creation_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "cmstp",
"match": { "program": "cmstp" },
"description": "Executing an attacker INF via CMSTP — LOLBin proxy execution",
"techniques": [{ "id": "T1218.003", "name": "System Binary Proxy Execution: CMSTP" }],
"telemetry": ["Sysmon EID 1: cmstp.exe processing an INF (often with a remote scriptlet)"],
"detections": [{ "source": "Sigma", "rule": "Proxy execution via CMSTP (proc_creation_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "msbuild-inline",
"match": { "program": "msbuild" },
"description": "Running an inline C# task via MSBuild — trusted-utility proxy execution",
"techniques": [{ "id": "T1127.001", "name": "Trusted Developer Utilities Proxy Execution: MSBuild" }],
"telemetry": ["Sysmon EID 1: msbuild.exe compiling/running an inline task from a project file"],
"detections": [{ "source": "Sigma", "rule": "Inline task execution via MSBuild (proc_creation_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "wscript-vbs",
"match": { "program": "wscript" },
"description": "Script-host execution via wscript (WSH) — VBScript/JScript",
"techniques": [{ "id": "T1059.005", "name": "Command and Scripting Interpreter: Visual Basic" }],
"telemetry": ["Sysmon EID 1: wscript.exe executing a script (.vbs/.js/.wsf)"],
"detections": [{ "source": "Sigma", "rule": "Script execution via wscript (proc_creation_win)", "confidence": "medium" }],
"noise": 50
},
{
"id": "cscript-vbs",
"match": { "program": "cscript" },
"description": "Script-host execution via cscript (WSH) — VBScript/JScript",
"techniques": [{ "id": "T1059.005", "name": "Command and Scripting Interpreter: Visual Basic" }],
"telemetry": ["Sysmon EID 1: cscript.exe executing a script (.vbs/.js/.wsf)"],
"detections": [{ "source": "Sigma", "rule": "Script execution via cscript (proc_creation_win)", "confidence": "medium" }],
"noise": 50
},
{
"id": "wmi-event-persist",
"match": { "line": { "contains": "eventconsumer" } },
"description": "WMI event subscription (EventFilter/Consumer) — persistence",
"techniques": [{ "id": "T1546.003", "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription" }],
"telemetry": ["WMI __EventFilter to CommandLineEventConsumer binding created", "Sysmon EID 20/21 (WMI event consumer/binding)"],
"detections": [{ "source": "Sigma", "rule": "WMI event subscription persistence (proc_creation_win)", "confidence": "high" }],
"noise": 70
},
{
"id": "accessibility-sethc",
"match": { "line": { "contains": "sethc.exe" } },
"description": "Accessibility feature hijack (sticky keys / utilman) — persistence / backdoor",
"techniques": [{ "id": "T1546.008", "name": "Event Triggered Execution: Accessibility Features" }],
"telemetry": ["Sysmon EID 13 (Registry Set): IFEO Debugger for sethc.exe/utilman.exe", "Sysmon EID 11 (File Create): replacement of sethc.exe"],
"detections": [{ "source": "Sigma", "rule": "Accessibility feature hijack (registry_set_win)", "confidence": "high" }],
"noise": 65
},
{
"id": "ifeo-debugger",
"match": { "line": { "contains": "image file execution options" } },
"description": "Image File Execution Options Debugger — persistence / hijack",
"techniques": [{ "id": "T1546.012", "name": "Event Triggered Execution: Image File Execution Options Injection" }],
"telemetry": ["Sysmon EID 13 (Registry Set): Debugger value under Image File Execution Options"],
"detections": [{ "source": "Sigma", "rule": "IFEO debugger persistence (registry_set_win)", "confidence": "high" }],
"noise": 65
},
{
"id": "winlogon-persist",
"match": { "line": { "contains": "\\winlogon" } },
"description": "Modifying Winlogon Shell/Userinit — logon persistence",
"techniques": [{ "id": "T1547.004", "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL" }],
"telemetry": ["Sysmon EID 13 (Registry Set): Winlogon Shell or Userinit value modified"],
"detections": [{ "source": "Sigma", "rule": "Winlogon helper persistence (registry_set_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "cmdkey-creds",
"match": { "program": "cmdkey", "args": { "contains": "/list" } },
"description": "Enumerating stored credentials via cmdkey — Credential Manager access",
"techniques": [{ "id": "T1555.004", "name": "Credentials from Password Stores: Windows Credential Manager" }],
"telemetry": ["Sysmon EID 1: cmdkey.exe /list enumerating saved credentials"],
"detections": [{ "source": "Sigma", "rule": "Credential Manager enumeration via cmdkey (proc_creation_win)", "confidence": "medium" }],
"noise": 45
},
{
"id": "findstr-creds",
"match": { "program": "findstr", "args": { "contains": "password" } },
"description": "Searching files for passwords via findstr — credential hunting",
"techniques": [{ "id": "T1552.001", "name": "Unsecured Credentials: Credentials In Files" }],
"telemetry": ["Sysmon EID 1: findstr scanning files for password strings"],
"detections": [{ "source": "Sigma", "rule": "Credential search via findstr (proc_creation_win)", "confidence": "low" }],
"noise": 50
},
{
"id": "av-discovery",
"match": { "line": { "contains": "antivirusproduct" } },
"description": "Enumerating installed AV via the AntiVirusProduct WMI class — security-software discovery",
"techniques": [{ "id": "T1518.001", "name": "Software Discovery: Security Software Discovery" }],
"telemetry": ["Sysmon EID 1: wmic querying AntiVirusProduct in root\\SecurityCenter2"],
"detections": [{ "source": "Sigma", "rule": "Security software discovery (proc_creation_win)", "confidence": "low" }],
"noise": 45
},
{
"id": "rdp-enable",
"match": { "line": { "contains": "fdenytsconnections" } },
"description": "Enabling RDP via the fDenyTSConnections registry value — remote access",
"techniques": [{ "id": "T1021.001", "name": "Remote Services: Remote Desktop Protocol" }],
"telemetry": ["Sysmon EID 13 (Registry Set): fDenyTSConnections set to 0"],
"detections": [{ "source": "Sigma", "rule": "RDP enabled via registry (registry_set_win)", "confidence": "high" }],
"noise": 60
},
{
"id": "netsh-portproxy",
"match": { "line": { "contains": "portproxy" } },
"description": "Local port forwarding via netsh portproxy — tunneling / pivot",
"techniques": [{ "id": "T1090.001", "name": "Proxy: Internal Proxy" }],
"telemetry": ["Sysmon EID 1: netsh interface portproxy add", "Sysmon EID 13 (Registry Set): portproxy configuration under Tcpip parameters"],
"detections": [{ "source": "Sigma", "rule": "Port forwarding via netsh portproxy (proc_creation_win)", "confidence": "high" }],
"noise": 55
},
{
"id": "wmic-shadow-delete",
"match": { "line": { "contains": "shadowcopy delete" } },
"description": "Deleting volume shadow copies via wmic — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: wmic shadowcopy delete"],
"detections": [{ "source": "Sigma", "rule": "Shadow copy deletion via wmic (proc_creation_win)", "confidence": "high" }],
"noise": 70
},
{
"id": "wbadmin-delete",
"match": { "program": "wbadmin", "args": { "contains": "delete" } },
"description": "Deleting backups/catalog via wbadmin — inhibit system recovery",
"techniques": [{ "id": "T1490", "name": "Inhibit System Recovery" }],
"telemetry": ["Sysmon EID 1: wbadmin delete catalog/backup"],
"detections": [{ "source": "Sigma", "rule": "Backup deletion via wbadmin (proc_creation_win)", "confidence": "high" }],
"noise": 68
},
{
"id": "timestomp-ps",
"match": { "line": { "contains": "lastwritetime" } },
"description": "Backdating a file's timestamps via PowerShell — timestomping",
"techniques": [{ "id": "T1070.006", "name": "Indicator Removal: Timestomp" }],
"telemetry": ["PowerShell 4104: setting a file's LastWriteTime/CreationTime"],
"detections": [{ "source": "Sigma", "rule": "Timestomping via PowerShell (ps_script)", "confidence": "medium" }],
"noise": 55
},
{
"id": "token-impersonation",
"match": { "line": { "contains": "invoke-tokenmanipulation" } },
"description": "Impersonating another process token via Invoke-TokenManipulation",
"techniques": [{ "id": "T1134.001", "name": "Access Token Manipulation: Token Impersonation/Theft" }],
"telemetry": ["PowerShell 4104: Invoke-TokenManipulation impersonating a process token"],
"detections": [{ "source": "Sigma", "rule": "Access token manipulation (ps_script)", "confidence": "high" }],
"noise": 65
}
]
}