Product

Detection catalog

Every check NEMUQU runs on uploaded evidence: what telemetry it needs, which ATT&CK techniques a finding from it can map to, the ordinary activity it is known to match, and how it decides. Generated from the detection code, so it lists what the analysis actually runs.

On this page

How to read this catalog

  • An ATT&CK technique on a check means a finding from it can map to that technique when the evidence supports it. The mapping describes what a behavior resembles. It is not proof that an adversary did anything, and a listed check is not a claim that a technique is covered in your environment.
  • NEMUQU does not run hunts or monitor your systems. It analyzes the evidence you upload, and it compiles hunt queries for you to run in your own tools.
  • A check runs when the evidence contains at least one of the telemetry types it lists. When none is present, the case records it as not run, with the reason, rather than as clean.
  • Known false positives are ordinary activity that produces the same pattern. Every finding repeats the ones that apply to it, beside the records it cites.
  • Statistical checks report rarity within the evidence you supplied. They produce observations, never findings, and map to no technique.

52 checks across 6 groups. Technique names are from the bundled MITRE ATT&CK data, version 19.2. Read the how it works page for what happens to a finding after a check fires.

Account compromise

Authentication and directory-audit analysis: failure bursts, source and device changes, and modifications to authentication factors.

Failed sign-ins followed by a success

Identifier
account.failure_burst_then_success version 0.1.2
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • A user repeatedly mistyping a password, or a stale password cached on a phone or mail client.
  • A service account whose credential expired and which retried on a loop.
  • A password manager or SSO client retrying automatically.
How it decides
Repeated authentication failures followed by a success for the same account.

Privileged directory role assigned

Identifier
account.privileged_role_assigned version 0.3.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • Planned delegation, or an approved just-in-time elevation.
How it decides
Fires on a directory audit record that assigns a privileged role (Global Administrator, Privileged Role Administrator, Security Administrator and similar in Entra; Super Administrator or Organization Administrator in Okta; Super Admin in Google Workspace; the AdministratorAccess policy attached to an AWS IAM user) to an account; it cites the record naming the role and the target. A record that removes a role does not fire it, and a record whose result is a failure never reaches it.

Several accounts signing in from one address

Identifier
account.multiple_identities_one_source version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • A corporate NAT gateway, VPN concentrator or proxy, which legitimately carries every user's traffic.
  • A shared workstation, terminal server or kiosk.
  • A mobile carrier NAT, which can front thousands of unrelated subscribers.
How it decides
Fires when one source address appears in sign-in events for at least four different accounts, unless that address fronts more than 80% of all accounts in the evidence, which marks it as shared infrastructure such as a corporate gateway rather than a spray.

Sign-in security information changed

Identifier
account.security_information_changed version 0.3.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • A user enrolling a new phone, which produces exactly this sequence.
  • A scheduled credential rotation or a helpdesk-assisted reset.
How it decides
A change to authentication factors, especially soon after a sign-in.

VPN sign-in after failures from the same address

Identifier
account.vpn_success_after_source_failures version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • A shared egress address (an office NAT or a mobile carrier) where one user's failures and another user's success happen to coincide.
  • A user who tried several usernames, for example with and without the domain, before the right one.
  • A VPN client retrying a stale saved credential before the user typed the current one.
How it decides
Fires when a VPN sign-in succeeds from a source address that recorded at least five failed VPN sign-ins in the 30 minutes before it, and at least one of those failures names a different account or no account. Failures that all name the successful account are left to the per-account check, so the same sequence is not reported twice.

Sign-in from a scripted or command-line client

Identifier
sigma.signin_scripted_user_agent version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • Genuine automation, integration jobs and monitoring that authenticate as a service account. These should be identifiable by the account, not by the user agent.
  • Security tooling that authenticates over an API on a schedule.
How it decides
Sigma rule "Sign-in from a scripted or command-line client": An interactive sign-in was recorded with a user agent belonging to a scripting library or command-line tool rather than a browser. Legitimate automation exists, but token theft and password spraying are both routinely driven from exactly these clients. The finding cites the record fields the rule's selection matched.

One account signing in from several addresses

Identifier
account.multiple_sources_short_window version 0.1.0
Kind
Statistical: rarity within the submitted evidence, reported as an observation only
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Maps to no ATT&CK technique: this check reports observations, which never become findings.
Known false positives
  • VPNs, mobile carrier NAT and cloud egress routinely produce this.
How it decides
One account authenticating from several addresses close together.

Sign-in at an unusual hour

Identifier
account.unusual_signin_hour version 0.1.0
Kind
Statistical: rarity within the submitted evidence, reported as an observation only
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Maps to no ATT&CK technique: this check reports observations, which never become findings.
Known false positives
  • Hours are in UTC as recorded in the evidence, which may not be the user's local time.
  • Travel, shift work or an occasional late sign-in by the same person.
How it decides
With at least twenty timestamped successful sign-ins, reports any UTC hour in which exactly one sign-in occurred. An observation only: rarity within the supplied sample, never a finding.

Phishing investigation

Header, authentication, link and attachment analysis for suspicious email. Nothing in this pack contacts the network.

Display name impersonation

Identifier
phishing.display_name_impersonation version 0.1.2
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
Can map to ATT&CK
Known false positives
  • Vendors and partners often send on behalf of a brand from their own bulk-mail domain.
  • An internal team whose display name does not match its mail domain.
How it decides
Fires when the From display name names an organization, brand or role that does not match the sending domain, or embeds an address on another domain; it cites the display name and the sending domain.

Lookalike sender domain

Identifier
phishing.lookalike_sender_domain version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
Can map to ATT&CK
Known false positives
  • Organizations legitimately own several similar domains for regional or brand reasons.
  • A genuine partner company with a coincidentally similar name.
How it decides
A sending domain one or two edits away from a recipient's own domain.

Recipients recorded in the message trace

Identifier
phishing.message_trace_recipients version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
  • Exchange message trace
Can map to ATT&CK
Maps to no ATT&CK technique: this check reports observations, which never become findings.
Known false positives
  • A message sent to many people on purpose, such as a newsletter or an all-staff notice, lists every recipient without implying harm.
How it decides
When a case holds both an email message and an Exchange message trace, lists the recipients and delivery statuses the trace records for that message's Message-ID, or states that no trace row carries it. An observation for scoping, never a finding.

Reply-To address on a different domain

Identifier
phishing.reply_to_mismatch version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
Can map to ATT&CK
Known false positives
  • Ticketing systems, CRMs and marketing platforms legitimately set a reply-to on their own domain.
  • A person sending from one address who wants replies at another.
How it decides
Fires when a message's Reply-To address is on a different domain from its From address, so replies would go somewhere other than the apparent sender; it cites both header values.

Sender authentication failed (SPF, DKIM or DMARC)

Identifier
phishing.authentication_failed version 0.1.2
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email authentication results (SPF/DKIM/DMARC)
Can map to ATT&CK
Known false positives
  • Mailing lists and forwarders routinely break SPF and DKIM without any malicious intent.
  • A legitimate sender with an incomplete SPF record or an unsigned third-party mail service.
  • Internal relays that re-write headers can invalidate a signature.
How it decides
SPF, DKIM or DMARC failure as reported by the receiving server.

Suspicious attachment

Identifier
phishing.suspicious_attachment version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
Can map to ATT&CK
Known false positives
  • Developers and administrators legitimately exchange scripts and archives.
  • Macro-enabled spreadsheets are still in normal use in many finance teams.
How it decides
Fires on an attachment whose declared filename has an executable, script or double extension, or whose declared type disagrees with its name; it cites the attachment record and never opens the file.
Identifier
phishing.suspicious_link version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Email message content or headers
Can map to ATT&CK
Known false positives
  • Marketing platforms rewrite every link through their own tracking domain, which looks identical to this.
  • Shorteners are used legitimately in newsletters and social posts.
How it decides
Links whose shape is characteristic of credential harvesting.

Business email compromise

Mailbox persistence and application access in Microsoft 365: inbox rules that forward or hide mail, forwarding set on a mailbox, and consent grants that give an application standing access.

Identifier
bec.oauth_high_privilege_consent version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Application consent records (Entra or unified audit log)
Can map to ATT&CK
Known false positives
  • Approval of a known vendor or line-of-business application (backup, e-signature, CRM, mail archiving) that needs this access.
  • An administrator onboarding a publisher-verified application on purpose.
How it decides
Fires on a successful consent, delegated permission grant or app role assignment (Entra audit or the Microsoft 365 unified audit log) whose recorded permissions include one that reads or sends mail, reads or writes files across sites, or changes the directory, such as Mail.Read, Mail.Send, Files.ReadWrite.All or Directory.ReadWrite.All. A consent for sign-in and basic profile only does not fire it; a consent whose permissions the record does not list is reported as an observation.

Inbox rule forwards mail out or hides it

Identifier
bec.inbox_rule_hides_or_forwards version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Mailbox rule changes (unified audit log)
Can map to ATT&CK
Known false positives
  • A user forwarding mail to a personal or partner address, where the organization permits it.
  • A user filing or deleting unwanted mail, such as newsletters or notifications, automatically.
  • An approved archiving, ticketing or migration process that copies mail elsewhere.
How it decides
Fires on a created or modified inbox rule (New-InboxRule, Set-InboxRule, or UpdateInboxRules from Outlook) that forwards or redirects mail to a domain outside every account domain in the supplied evidence, deletes messages, or moves them to a low-visibility folder (RSS Feeds, RSS Subscriptions, Conversation History, Deleted Items, Junk Email, Archive). Rules recorded as failed, removals, and rules that only file mail into other folders do not fire it.

Mailbox forwarding set to an outside address

Identifier
bec.mailbox_external_forwarding version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Mailbox configuration changes (unified audit log)
Can map to ATT&CK
Known false positives
  • An administrator forwarding a departed employee's mail to a manager's external address, or to a partner during a transition.
  • A user forwarding to a personal address where the organization permits it.
How it decides
Fires on Set-Mailbox setting ForwardingSmtpAddress to an address whose domain is outside every account domain in the supplied evidence. Forwarding to a recipient object (ForwardingAddress), whose destination the record does not show, is reported as an observation; clearing forwarding and failed operations do not fire it.

Cloud identity and audit logging

Google Workspace, Okta and AWS CloudTrail: audit logging turned off, credentials issued for another user, factor resets followed by a sign-in, and broad OAuth grants.

Application granted broad access in Google Workspace or Okta

Identifier
cloud.oauth_broad_scope_grant version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Application consent records (Entra or unified audit log)
Can map to ATT&CK
Known false positives
  • A known mail client, backup, archiving or e-discovery product that needs full mailbox or drive access.
  • An identity-governance or directory-sync tool approved to manage Okta users and groups.
How it decides
Fires on a Google Workspace token authorize event or a successful Okta app.oauth2 grant event whose recorded scopes include one on a short list of broad scopes: full Gmail access or Gmail read, modify, send or settings scopes, full or read-only Drive, Admin SDK directory user, group or role management, cloud-platform (Google); okta.*.manage management API scopes (Okta). Sign-in and profile scopes and narrow ones such as drive.file do not fire it; a grant whose scopes the record does not list is reported as an observation.

AWS access key or console password created for another user

Identifier
cloud.aws_credential_for_another_user version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • An administrator onboarding a new user or service account and issuing its first key or password.
  • A help-desk password reset for a user locked out of the console.
  • A provisioning role or pipeline that creates keys for service users by design.
How it decides
Fires on a successful IAM CreateAccessKey, CreateLoginProfile or UpdateLoginProfile call whose request names a user other than the calling IAM user (or any user, when the caller is a role, a federated session or the root user). A call with no userName applies to the caller itself and does not fire it. When the record does not identify the caller, it is reported as an observation.

CloudTrail logging stopped or trail deleted

Identifier
cloud.cloudtrail_logging_stopped version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Security product audit events
Can map to ATT&CK
Known false positives
  • A planned change of logging design, such as moving from per-account trails to an organization trail, with the old trail deleted afterwards.
  • Infrastructure-as-code (Terraform, CloudFormation) replacing a trail, which deletes and recreates it.
  • A sandbox or test account being decommissioned.
How it decides
Fires on a successful CloudTrail StopLogging or DeleteTrail call (no errorCode in the record), citing the operation, the trail and the principal that made it. UpdateTrail and PutEventSelectors/PutAdvancedEventSelectors change what a trail records without stopping it, and are reported as observations because the record alone does not show whether less is now logged. Calls AWS refused (AccessDenied and similar) never reach this check.

Sign-in factor reset or removed, then a sign-in

Identifier
cloud.mfa_removed_then_sign_in version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • A user who lost or replaced a phone, had their factors reset by the help desk, and signed in again to enroll a new one.
  • An administrator removing a factor for a user who is moving to a different method.
How it decides
In Okta, Google Workspace or AWS IAM evidence, fires when a successful change that leaves an account with fewer authentication factors (Okta user.mfa.factor.deactivate, reset_all or suspend; Google 2sv_disable or Advanced Protection unenrollment; IAM DeactivateMFADevice or DeleteVirtualMFADevice) is followed within 12 hours by a successful sign-in for the same account from the same provider. It needs both kinds of record in the evidence. When the factor was reset by someone other than the account and the sign-in comes from an address the same account signed in from before the change, it is reported as an observation instead.

Linux host compromise

Recorded SSH failure-to-success sequences, command-pattern leads, account and group changes, file changes and audit-control changes, from auth.log, the systemd journal and auditd.

Account added to a privileged Linux group

Identifier
linux.privileged_group_addition version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • A planned grant of administrative access.
How it decides
Fires when a group-membership change on a Linux host adds an account to sudo, wheel, admin, root, docker, lxd, shadow or disk.

Cron or systemd persistence

Identifier
linux.cron_or_systemd_persistence version 0.2.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Scheduled task or crontab changes
  • File creation telemetry
  • File modification telemetry
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • An administrator adding a backup, certificate-renewal or maintenance job.
  • A package installing and enabling its own service.
How it decides
Fires on a crontab replacement logged by cron, an audit record of a write to a cron directory, a systemd unit or timer, rc.local or init.d. Commands that could install or enable these are observations, and changed configuration does not prove execution.

Download piped to a shell

Identifier
linux.download_piped_to_shell version 0.2.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Vendor install instructions and configuration-management bootstrap scripts can contain this pattern.
How it decides
Records an observation when Linux command text contains a curl, wget or fetch pipeline or substitution into a shell. Text alone does not establish a download or execution of returned content. Source: sudo and cron log entries, or audit execve records.

Linux account created

Identifier
linux.account_created version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • Onboarding a person, or a package creating its service account.
How it decides
Fires on a useradd record, or an audit ADD_USER record, that creates a local account on a Linux host. Severity is high when the new account has user ID 0.

Log or shell history tampering

Identifier
linux.log_or_history_tampering version 0.3.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
  • File deletion telemetry
  • Security product audit events
Can map to ATT&CK
Known false positives
  • An administrator freeing space on a full disk, or removing a password typed into a shell by mistake.
  • Reloading audit rules deletes them first (auditctl -D) as part of augenrules.
How it decides
Fires on an audit record deleting a history or log file, removing audit rules, disabling auditing or stopping the audit daemon. Related command patterns are separate observations with unknown effects.

SSH authorized_keys file modified

Identifier
linux.ssh_authorized_keys_modified version 0.2.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • File creation telemetry
  • File modification telemetry
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • An administrator or ssh-copy-id installing a colleague's key, or configuration management distributing keys.
How it decides
Fires on an audit record of a change to a .ssh/authorized_keys file. Command patterns that could write one are observations; neither proves a usable key was added.

SSH failures followed by a success from one address

Identifier
linux.ssh_failures_then_success version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • An administrator or a deployment tool trying several account names or a stale password before the right one.
  • A vulnerability scanner your organization runs against its own hosts.
How it decides
Fires when one source address has at least five failed SSH authentications on one host within fifteen minutes, against any accounts, and a successful SSH sign-in from the same address to the same host follows within thirty minutes. Without the success it reports the burst at medium severity.

Sudo request denied

Identifier
linux.sudo_denied version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Authentication / sign-in logs
Can map to ATT&CK
Known false positives
  • A user who expected administrative rights they do not have, or followed instructions written for another machine.
How it decides
Fires when sudo logs that an account is not in the sudoers file or is not allowed to run the command it asked for. Wrong-password entries are left to the failure-burst checks.

Sudoers file modified

Identifier
linux.sudoers_modified version 0.2.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • File creation telemetry
  • File modification telemetry
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • An administrator granting access through visudo, or configuration management deploying a sudoers.d file.
How it decides
Fires on an audit record of a write to /etc/sudoers or a file in /etc/sudoers.d, or a command pattern that redirects, tees, copies or edits into those paths is retained separately as an observation with an unknown outcome.

Windows compromise

Execution chains, persistence and defense evasion on Windows endpoints, from EVTX, Sysmon and Defender telemetry.

Account added to a privileged Windows group

Identifier
windows.privileged_group_addition version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • A planned administrative delegation or a routine role change.
How it decides
Fires when a group-membership change adds a member to Administrators, Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators or Remote Desktop Users.

Autorun registry key changed

Identifier
windows.run_key_modified version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Registry modification telemetry
Can map to ATT&CK
Known false positives
  • Many legitimate applications add themselves to autorun on install.
  • User-installed utilities frequently register a startup entry.
How it decides
Fires when a registry change targets a Run, RunOnce or RunServices autorun key; it cites the key path and the value written.

Download command in a command line

Identifier
windows.powershell_download version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Package managers, build scripts and deployment tooling download by design.
  • Administrators commonly fetch scripts from an internal repository this way.
How it decides
Fires when a process command line contains a download construct (DownloadString, Invoke-WebRequest, curl, certutil -urlcache and similar); severity rises when the same command also executes what it retrieved.

Office application starts a shell or script host

Identifier
windows.office_spawns_interpreter version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • An Office add-in or macro that the organization deploys deliberately.
  • A document template that legitimately automates a local task.
  • Software deployment or IT automation triggered from within Office.
How it decides
An Office application starting a shell or script host.

Persistence requested from the command line

Identifier
windows.persistence_via_command_line version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Software installers and management agents create tasks and services this way as a matter of course.
  • Administrators script exactly these commands during provisioning.
How it decides
A command requests persistence; its success needs separate evidence.

PowerShell with an encoded command

Identifier
windows.encoded_powershell version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Management tooling and installers legitimately pass encoded commands to avoid quoting problems.
  • Some monitoring agents and RMM products encode their own scheduled work.
How it decides
PowerShell invoked with a base64-encoded command.

Scheduled task created

Identifier
windows.scheduled_task_created version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Scheduled task creation events
Can map to ATT&CK
Known false positives
  • Software installers and updaters create scheduled tasks routinely.
  • Backup, monitoring and management agents all use scheduled tasks.
How it decides
Fires on every scheduled-task creation record and reports the task name and action; whether the task is legitimate is left to the analyst, with the benign explanations listed.

Service installed

Identifier
windows.service_created version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Windows service creation events
Can map to ATT&CK
Known false positives
  • Any software installation may register a service.
  • Management agents install services as part of enrolment.
How it decides
Fires on every service-installation record; severity rises when the image path points at an interpreter, a temporary or per-user directory, or carries an encoded command.

Signed Windows binary used to run other code

Identifier
windows.suspicious_lolbin version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Legacy line-of-business applications sometimes install COM scriptlets.
  • Some vendor installers legitimately use regsvr32 and rundll32.
How it decides
Signed Windows binaries used to execute other code.

Web browser starts a script host or shell

Identifier
windows.browser_spawns_script_host version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • A user deliberately running an installer or script they downloaded.
  • Browser-integrated enterprise tooling that shells out by design.
How it decides
Fires when a web browser process is recorded as the parent of a script host or shell (wscript, cscript, mshta, powershell, cmd and similar) in the same process-creation record.

Windows account created

Identifier
windows.account_created version 0.1.0
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Directory or account audit logs
Can map to ATT&CK
Known false positives
  • Ordinary onboarding or provisioning of a new user or service account.
How it decides
Fires on a record that creates a local or domain user account (Security event 4720 or an equivalent account-change record naming a new target account).

Windows event log cleared

Identifier
windows.event_log_cleared version 0.1.1
Kind
Deterministic: an explicit pattern in the records
Needs at least one of
  • Security product audit events
Can map to ATT&CK
Known false positives
  • An administrator clearing logs during troubleshooting or before imaging.
How it decides
Clearing the Windows audit log.

Autorun registry value launches a script interpreter

Identifier
sigma.run_key_launches_interpreter version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Registry modification telemetry
Can map to ATT&CK
Known false positives
  • Login scripts deployed by an administrator, which do sometimes use cmd or PowerShell from an autorun key.
  • Older installers that register a first-run configuration step this way.
How it decides
Sigma rule "Autorun registry value launches a script interpreter": A Run or RunOnce registry value was set to a command line that invokes PowerShell, cmd, a script host or a LOLBin. Autorun entries pointing at an installed application are ordinary; autorun entries pointing at an interpreter are how commodity malware survives a reboot. The finding cites the record fields the rule's selection matched.

certutil used to decode or download a file

Identifier
sigma.certutil_decode_or_download version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Certificate enrolment tooling that legitimately uses certutil to move certificate files around.
  • An administrator inspecting a certificate revocation list by hand.
How it decides
Sigma rule "certutil used to decode or download a file": certutil.exe is a certificate utility that also happens to base64-decode arbitrary files and fetch arbitrary URLs. Both are used to stage payloads past controls that watch for more obvious downloaders. The finding cites the record fields the rule's selection matched.

Microsoft Defender exclusion added

Identifier
sigma.defender_exclusion_added version 2026-10-16
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • A documented exclusion for a line-of-business application that a vendor requires; database and build servers commonly have several.
  • Endpoint management tooling applying an approved exclusion policy.
How it decides
Sigma rule "Microsoft Defender exclusion added": A path, extension or process was excluded from Microsoft Defender scanning. Attackers add an exclusion first and stage the payload into it second, so the payload is never examined. The finding cites the record fields the rule's selection matched.

Remote process creation with wmic

Identifier
sigma.wmic_remote_process_creation version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Administrative scripts that manage servers remotely; some estates run these on a schedule.
  • Software deployment tooling that uses WMI as its transport.
How it decides
Sigma rule "Remote process creation with wmic": wmic.exe was used with /node: to start a process on another machine. This is a legitimate administrative capability and one of the most common ways an intruder moves laterally without dropping a tool. The finding cites the record fields the rule's selection matched.

Service installed from a user-writable location

Identifier
sigma.service_from_user_writable_path version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Windows service creation events
Can map to ATT&CK
Known false positives
  • Some legitimate agents install per-machine services under ProgramData; endpoint management and backup products are the usual examples.
  • Developer tooling registering a local service during a build.
How it decides
Sigma rule "Service installed from a user-writable location": A Windows service was registered with an executable living under a user profile, a temporary directory or ProgramData. Services normally run from Program Files or System32; a service binary somewhere a normal user can write is a persistence mechanism that also survives reboot as SYSTEM. The finding cites the record fields the rule's selection matched.

Volume shadow copies deleted

Identifier
sigma.shadow_copy_deletion version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Backup software rotating its own shadow copies on a schedule.
  • An administrator reclaiming disk space on a server that is short of it.
  • Imaging or provisioning tooling cleaning a golden image before capture.
How it decides
Sigma rule "Volume shadow copies deleted": A command was run that deletes Windows volume shadow copies. Ransomware does this immediately before or after encryption so that the built-in restore path is gone by the time anyone notices. The finding cites the record fields the rule's selection matched.

Windows recovery options disabled with bcdedit

Identifier
sigma.bcdedit_recovery_disabled version 2026-08-27
Kind
Sigma rule: a published rule evaluated against normalized events
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Known false positives
  • Deliberate configuration on a kiosk, embedded or lab machine that should never stop at a recovery prompt.
  • Imaging tooling setting boot policy during provisioning.
How it decides
Sigma rule "Windows recovery options disabled with bcdedit": Boot configuration was changed to disable automatic repair or to ignore boot failures. Ransomware does this alongside shadow copy deletion so the machine cannot self-recover. The finding cites the record fields the rule's selection matched.

External destination seen once

Identifier
windows.first_seen_external_destination version 0.1.0
Kind
Statistical: rarity within the submitted evidence, reported as an observation only
Needs at least one of
  • Endpoint or network connection telemetry
Can map to ATT&CK
Maps to no ATT&CK technique: this check reports observations, which never become findings.
Known false positives
  • Rarity is measured only against what you uploaded, so an ordinary destination contacted once in that sample is reported.
How it decides
With at least five network-connection records, reports each public destination that appears exactly once in the supplied evidence. An observation only: a first contact within the sample, not proof of anything.

Rare parent and child process pair

Identifier
windows.rare_parent_child version 0.1.0
Kind
Statistical: rarity within the submitted evidence, reported as an observation only
Needs at least one of
  • Endpoint process creation
Can map to ATT&CK
Maps to no ATT&CK technique: this check reports observations, which never become findings.
Known false positives
  • Rarity is measured only against what you uploaded, not against a baseline of your environment, so an ordinary pair that happens to appear once is reported.
How it decides
With at least twenty process-creation records, reports parent/child process pairs that occur only once in the supplied evidence. An observation only: rarity within the sample, never a finding.

Related information

  • How it works

    From upload to cited findings, unknowns and hunts.

  • Evidence formats

    What NEMUQU accepts and what each format can show.

  • Demo cases

    Synthetic investigations with findings and their citations.