Critical 154High 1829Medium 1533Low 447Informational 31
OPEN DETECTION INTELLIGENCE
⊞Windows3244◉Linux216△Azure127
RULE CONVERTER
Turn Sigma into a SIEM-ready query.
Paste your own rule or send one directly from the detection index.
5 TARGETS READY
QUICK SEARCH
3994 RULES MATCHING ALL SYSTEMS
PAGE 1 / 400medium612e47e9-8a59-43a6● test3 VARIANTS2026-08-31
ServiceDll Hijack
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.
Windowsattack.persistenceattack.privilege-escalation
high4a7e2f1d-8c3b-4e9f● experimental2026-08-30
Certutil Download Cradle Usage
Detects certutil invocations containing flags associated with downloading files from remote locations. Certutil is a legitimate certificate management utility that is frequently abused to download payloads from attacker-controlled infrastructure. The -urlcache and -split flags are rarely used in legitimate PKI administration.
Windowsattack.command_and_controlattack.t1105
medium8b3f5e2a-1d7c-4f9e● experimental2026-08-30
Certutil Encode or Decode Activity
Detects certutil invocations used to encode or decode file content. Attackers frequently use certutil to decode obfuscated payloads delivered through phishing or other initial access techniques. The -decode, -encode, and -decodehex flags are rarely used in legitimate administrative scenarios on general purpose endpoints.
Windowsattack.defense_evasionattack.t1140
high2e9c4a7f-5b1d-4e3c● experimental2026-08-30
Certutil Spawned by Suspicious Parent Process
Detects certutil spawned by parent processes commonly associated with phishing-based initial access including Office applications and scripting engines. This parent-child relationship is a strong indicator of malicious document or file execution using certutil for payload delivery or decoding.
Windowsattack.executionattack.t1105
medium3a8f4d2e-7b1c-4a6f● experimental2026-08-30
Mshta Executing Content from Suspicious Path
Detects mshta executing content from temporary or user-writable directories which are commonly used to stage malicious HTA files. Legitimate mshta usage typically involves content installed in standard application directories rather than temporary or user profile locations.
Windowsattack.defense_evasionattack.t1218.005
high6f1b3d8e-4a2c-4f7e● experimental2026-08-30
Mshta Executing Remote Content
Detects mshta invocations referencing remote URLs or UNC paths indicating execution of remotely hosted HTML Application content. Legitimate mshta usage typically involves locally installed HTA files and rarely references external URLs or network shares. This technique is commonly observed in phishing campaigns and post-exploitation scenarios.
Windowsattack.defense_evasionattack.t1218.005
high9d2e5f1b-3c7a-4e8d● experimental2026-08-30
Mshta Spawned by Suspicious Parent Process
Detects mshta spawned by parent processes commonly associated with phishing-based initial access. Mshta being launched by Office applications or scripting engines is a strong indicator of a malicious document or file execution attempting to abuse the HTML Application host for code execution.
Windowsattack.defense_evasionattack.t1218.005
high5e3b8f1a-4d2c-4e7f● experimental2026-08-30
Regsvr32 Loading Remote Content
Detects regsvr32 invocations referencing remote URLs indicating attempts to load remotely hosted COM scriptlets. Legitimate regsvr32 usage involves registering locally installed DLL files and does not require reaching out to remote URLs.
Windowsattack.defense_evasionattack.t1218.010
high1f6c3e9a-8b4d-4f2e● experimental2026-08-30
Regsvr32 Loading SCT Scriptlet File
Detects regsvr32 invocations referencing COM scriptlet files with the .sct extension. SCT files are commonly used in LOLBin abuse scenarios to execute malicious script content through the trusted regsvr32 binary. Legitimate regsvr32 usage involves DLL registration and does not typically reference .sct files.
Windowsattack.defense_evasionattack.t1218.010
high8d4f2b6e-1a3c-4e9d● experimental2026-08-30
Regsvr32 Spawned by Suspicious Parent Process
Detects regsvr32 spawned by parent processes commonly associated with phishing-based initial access. Regsvr32 being launched by Office applications or scripting engines is a strong indicator of malicious document execution attempting to abuse regsvr32 for payload execution or AppLocker bypass.
Windowsattack.defense_evasionattack.t1218.010