Sigma endpoint pack: seven rules for the Windows techniques that keep working

What this pack is for

Seven rules for techniques that appear in intrusion after intrusion because they use what Windows ships with. None of them is clever. They are the rules an estate should have before it has anything else, written so that each one can be read in a minute and tuned in an afternoon.

What you need switched on

A rule cannot fire on an event that was never written. Check these before you deploy, because an empty result from a rule whose telemetry is off looks exactly like a clean estate.

Rule	Needs	On by default
Shadow copy deletion, LSASS dump, encoded PowerShell, scheduled task	Process creation with command line: Sysmon event 1, or Security 4688 with "Include command line in process creation events" enabled	No
Service install	System log, event 7045	Yes
WMI subscription	Sysmon events 19, 20 and 21 (WmiEvent in the config)	No
Security log cleared	Security log, event 1102	Yes

OriginalFileName is a Sysmon field and is absent from 4688. The rules that use it pair it with Image, so they still work on 4688, but only Sysmon catches a renamed binary.

How they were tested, and how they were not

Every rule in this pack parses under pySigma, converts cleanly to a Splunk query with the pySigma Splunk backend, and passes the pySigma core validators with no issues. sigma check over the directory reports no errors, no condition errors and no validation issues. The regular expressions were exercised against constructed command lines.

They have not been run against production telemetry. That is the part only you can do, and it is the part that matters: a rule's false positive rate is a property of your estate, not of the rule. Deploy each one in a non-alerting mode for a week, read what it matched, extend the filters, and only then let it page somebody.

Converting

pip install sigma-cli
sigma plugin install splunk sysmon windows   # a backend, plus the two pipelines
sigma convert -t splunk -p sysmon -p splunk_windows rules/sigma/

The sysmon pipeline maps the generic process_creation category to Sysmon event 1. Run sigma list pipelines to see what your backend offers; if you collect Security 4688 instead of Sysmon, use the windows-audit pipeline from the windows plugin in its place.

Tuning notes that apply to all seven

• Exclude by signer and parent, never by command line. The command line is the part the operator controls.
• Give every exclusion an owner and an expiry date. A filter added at 2am for a noisy backup agent is how a correct rule ends up disabled for the one intrusion it was written for.
• Keep the severity honest. The LSASS rule is critical because nothing legitimate matches it. The encoded PowerShell rule is medium because plenty does. Promote a rule when your tuning has earned it.

The files

Shadow copy deletion or recovery inhibition

T1490. The destruction sequence before encryption. High severity: by the time this fires the window is minutes.

Download proc_creation_win_shadow_copy_deletion.yml · 53 lines · 1.7 KB

title: Shadow Copy Deletion Or Recovery Inhibition Via Built-In Tools
id: 6c4009db-0396-448a-a727-aa8af5d4b8fb
status: experimental
description: |
  Detects the destruction sequence that precedes most ransomware encryption: deleting volume
  shadow copies, deleting the backup catalogue, or disabling Windows recovery. The commands are
  usually seconds apart and run from one account on one host, which makes the first hit the
  timestamp worth building the timeline around.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.cisa.gov/stopransomware/ransomware-guide
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Win32_ShadowCopy'
      - 'Delete'
  condition: 1 of selection_*
falsepositives:
  - Backup agents that prune shadow copies on a schedule. Exclude by the agent's signed parent image, never by command line alone.
  - Administrators reclaiming disk space by hand. Rare enough to be worth a conversation each time.
level: high

LSASS dump via comsvcs MiniDump

T1003.001. Matches the export by name and by ordinal, because operators use the ordinal to dodge rules that match the word.

Download proc_creation_win_lsass_dump_comsvcs.yml · 34 lines · 1.1 KB

title: LSASS Memory Dump Via Comsvcs MiniDump
id: c53f8a78-5884-4fb2-a109-07c068fac9c5
status: experimental
description: |
  Detects rundll32 calling the MiniDump export of comsvcs.dll, the living-off-the-land route to
  an LSASS dump that needs no tooling on disk. The export can be called by ordinal (#24), so the
  rule matches the DLL name with either spelling of the export rather than the word alone.
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://lolbas-project.github.io/lolbas/Libraries/comsvcs/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
  selection_dll:
    CommandLine|contains: 'comsvcs'
  selection_export:
    CommandLine|contains:
      - 'MiniDump'
      - '#24'
      - '#-4294967272'
  condition: all of selection_*
falsepositives:
  - None expected in production. A hit is either an intrusion or a red team, and both deserve a call.
level: critical

PowerShell with a long encoded command

T1059.001. Matches every abbreviation of -EncodedCommand, with a length floor to drop short management one-liners.

Download proc_creation_win_powershell_encoded_long.yml · 40 lines · 1.5 KB

title: PowerShell Launched With A Long Encoded Command
id: b0c3657f-7f1b-4a4b-b84f-8bf0f2b2918d
status: experimental
description: |
  Detects PowerShell started with any abbreviation of -EncodedCommand followed by at least
  forty characters of base64. PowerShell accepts every unambiguous prefix of the parameter
  (-e, -en, -enc, -enco and so on), which is why a rule that matches the literal word misses most
  real use. The length floor removes the short encoded one-liners management agents produce.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    - OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'
  selection_encoded:
    CommandLine|re: '(?i)\s[-/]e[a-z]{0,13}\s+[A-Za-z0-9+/]{40,}={0,2}'
  filter_optional_management:
    ParentImage|endswith:
      - '\CCM\CcmExec.exe'
      - '\Microsoft Intune Management Extension\AgentExecutor.exe'
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Configuration management and RMM agents that wrap scripts in -EncodedCommand. Baseline the parent images in your estate and extend the filter; do not remove the rule.
level: medium

Scheduled task running from a user-writable path

T1053.005. Needs command-line logging. Expect per-user updaters; exclude by task name and signer.

Download proc_creation_win_schtasks_user_writable_path.yml · 40 lines · 1.3 KB

title: Scheduled Task Created To Run From A User-Writable Path
id: 0f880392-aae4-40c3-93a5-41ba717aa563
status: experimental
description: |
  Detects schtasks.exe creating a task whose action points into a directory any user can write
  to. Legitimate installers register tasks that run from Program Files or System32; a task that
  runs from Public, Temp, AppData or ProgramData is either persistence or software worth knowing
  about.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.execution
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'
  selection_create:
    CommandLine|contains: '/create'
  selection_path:
    CommandLine|contains:
      - '\Users\Public\'
      - '\AppData\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '%TEMP%'
      - '%APPDATA%'
      - '%PUBLIC%'
  condition: all of selection_*
falsepositives:
  - Per-user updaters (browsers, chat clients, Zoom) registering tasks from AppData. Exclude by exact task name and signed binary, not by directory.
level: medium

Service installed with a suspicious image path

T1543.003 and T1569.002. Event 7045 is on by default, which makes this the cheapest rule in the pack.

Download win_system_service_install_suspicious_path.yml · 44 lines · 1.4 KB

title: Service Installed With A Suspicious Image Path
id: d9343f55-910f-44f9-b46b-60e99f5a8354
status: experimental
description: |
  Detects event 7045 (a service was installed) where the image path runs a script interpreter or
  lives in a user-writable directory. Remote service creation is how PsExec-style lateral
  movement and a good share of persistence both land, and 7045 is written by default with no
  audit policy needed.
references:
  - https://attack.mitre.org/techniques/T1543/003/
  - https://attack.mitre.org/techniques/T1569/002/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection_event:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  selection_path:
    ImagePath|contains:
      - 'powershell'
      - 'pwsh'
      - 'cmd.exe /c'
      - 'cmd /c'
      - '%COMSPEC%'
      - 'rundll32'
      - 'regsvr32'
      - 'mshta'
      - '\Users\Public\'
      - '\AppData\'
      - '\Windows\Temp\'
      - 'ADMIN$'
  condition: all of selection_*
falsepositives:
  - Deployment tooling that installs a temporary service from ADMIN$, PsExec used by your own administrators included. Decide whether that is allowed; if it is, exclude by source host rather than by service name, which the operator chooses.
level: high

WMI event subscription created

T1546.003. Requires Sysmon with WmiEvent enabled. Baseline once; the legitimate set is small and stable.

Download sysmon_wmi_event_subscription.yml · 34 lines · 1.3 KB

title: WMI Event Subscription Created
id: f4ea9f7d-cd07-4968-b0f2-2b1327bbdf08
status: experimental
description: |
  Detects the three Sysmon events written when a permanent WMI event subscription is registered:
  the filter (19), the consumer (20) and the binding that joins them (21). Subscriptions survive
  reboots, run as SYSTEM and leave nothing in the Run keys, services or scheduled tasks, which
  is why they are missed by anybody checking only those.
references:
  - https://attack.mitre.org/techniques/T1546/003/
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.003
logsource:
  product: windows
  category: wmi_event
detection:
  selection:
    EventID:
      - 19
      - 20
      - 21
  filter_optional_default_binding:
    Consumer|contains: 'SCM Event Log Consumer'
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - The binding Windows ships with (SCM Event Log Filter to SCM Event Log Consumer), which the optional filter removes.
  - Management software that registers its own subscriptions at install time (SCCM, some OEM utilities and hardware monitoring agents). These are few and stable, so baseline them once by consumer name.
level: medium

Security audit log cleared

T1685.005 in ATT&CK v19, T1070.001 before it and in the rule's own tags. Event 1102 survives the clearing because it is the first record of the new log.

Download win_security_audit_log_cleared.yml · 30 lines · 1.2 KB

title: Windows Security Audit Log Cleared
id: 47314a5d-b106-4122-9dce-99f9de29c209
status: experimental
description: |
  Detects event 1102, written to the Security log when that log is cleared. The event survives
  the clearing because it is the first record in the new log, and it names the account that did
  it. Almost nobody clears the Security log for an operational reason. ATT&CK v19 moved this
  technique to T1685.005 under Defense Impairment. The tags below keep the earlier T1070.001,
  because that is the identifier Sigma tooling and most SIEM ATT&CK mappings still validate.
references:
  - https://attack.mitre.org/techniques/T1685/005/
  - https://attack.mitre.org/techniques/T1070/001/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-1102
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.defense-evasion
  - attack.t1070.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 1102
    Provider_Name: 'Microsoft-Windows-Eventlog'
  condition: selection
falsepositives:
  - Image preparation before a machine is handed over (sysprep workflows). Should never appear on a machine already in service.
level: high