Detection rules, tested on real logs.Then on what they miss.

Each rule runs on its own disposable Windows machine against a real test. To pass, it has to alert on the attack and stay quiet on normal activity.

Harmless variations of each game and license attack. Misses are recorded rather than hidden, and any change from the record fails the run.

• Edit hosts with PowerShell instead of a cmd redirectLicense Server Redirected Through the Hosts File
  Caught
  The rule first only looked for a > in the command, and now knows the PowerShell ways to write a file.
• Edit hosts from a script fileLicense Server Redirected Through the Hosts File
  Missed
  The command line only shows the script's name. Catching this needs file monitoring on hosts.
• Plant the DLL with an uppercase nameGame Loaded a System DLL From Outside the Windows Folder
  Caught
  Rule matching ignores case.
• Plant the DLL next to a renamed copy of the gameGame Loaded a System DLL From Outside the Windows Folder
  Missed
  The rule and the Sysmon config both go by the game's file name, so these DLL loads aren't logged.
• Request full access to the game's memoryProcess Requested Write Access to Game Memory
  Missed
  A launcher gets full access to the game too, so the rule leaves this value out to avoid false alerts.
• Request only the rights needed to write memoryProcess Requested Write Access to Game Memory
  Caught
  The rule's list of values first assumed read access was requested too.
• Run the modified copy under a different file nameGame Running From an Unofficial Build
  Caught
  The rule first only checked the file name, and now also reads the name stored inside the file.
• Guess keys while changing the reported machine IDLicense Key Guessing From One Address
  Caught
  The rule counts by address, which the client can't choose as easily.
• Guess keys from many addressesLicense Key Guessing From One Address
  Missed
  The rule counts each address separately. Counting across addresses needs tuning against real traffic.
• Share a key among users reporting the same machine IDOne License Key Activated on Too Many Machines
  Missed
  The rule trusts the machine ID the client reports. In production, counting addresses per key could help.

Normal activity, scored against every rule. A rule that fires on normal behavior buries analysts in bad alerts.

• Normal session with the official gameNo rules
  Quiet
  Nothing unusual happens.
• Launcher starts and stops the gameNo rules
  Quiet
  The memory rule leaves out full access, because launchers get it too.
• Launch day with 60 players activatingNo rules
  Quiet
  Each player has a real key on one machine.
• Small LAN event with 12 players mistyping onceNo rules
  Quiet
  Set off the guessing rule until its threshold went from 10 different keys to 20.
• Family sharing one PC with their own keysNo rules
  Quiet
  The sharing rule counts machines per key, not keys per machine.
• Official update before its hash reaches the listGame Running From an Unofficial Build
  Sets off rules
  A new build looks like a bootleg until it's listed, so a release has to publish its hash first.
• Overlay opens the game with write accessProcess Requested Write Access to Game Memory
  Sets off rules
  Overlays can ask for the same access as cheats. Allowing one by file name would be easy to fake, so this needs signature checks.
• Mod manager adds a DLL to the game's folderGame Loaded a System DLL From Outside the Windows Folder
  Sets off rules
  A legitimate mod and a crack load the same way, so telling them apart needs a list of approved mods.
• Admin tool runs an encoded PowerShell commandPowerShell Launched With Encoded Command (Defender XDR), PowerShell Launched With Encoded Command
  Sets off rules
  Some management software uses encoded commands, so these rules need an allowlist tuned to each environment.
• School or large LAN event with 30 players mistyping onceLicense Key Guessing From One Address
  Sets off rules
  Everyone shares one address. Grouping by machine too would stop this, but guessers can change their reported machine ID.
• Player sets up a new PC within the hourOne License Key Activated on Too Many Machines
  Sets off rules
  A third machine in an hour goes past the two allowed seats. It looks the same as the start of key sharing.

Rules pass or fail on engines this project wrote, so the real logs also go into a real Elasticsearch, which runs the 9 Sigma rules after standard conversion. These are the results where the two disagree.

• Game Loaded a System DLL From Outside the Windows Folderevasion/dll-uppercase-name
  Differs
  Project engine fires, Elasticsearch quiet. Elastic's converted query is case-sensitive, so it misses WINMM.DLL. Sigma rules are meant to ignore case.
• PowerShell Launched With Encoded Commandnoise/admin-encoded-command
  Differs
  Project engine fires, Elasticsearch quiet. Elastic's converted query is case-sensitive, so it misses -EncodedCommand. That removes this noise, but also a real detection.

Mistakes and surprises that only showed up on real logs and real tools. Each one links to its run.

1. Phase 2

   Windows doubled the percent signs

   A command run with %VAR% was logged as %%VAR%%, so the simulated logs had to change to match.

2. Phase 2

   The DLL was never really planted

   The .NET runtime loads version.dll before the game's code runs, so the planted copy went unused. The rule was right to stay quiet, and the test was wrong.

3. Phase 2

   Windows changes the access it logs

   A request for 0x0438 is logged as 0x1438, so a rule looking only for the requested value would miss it.

4. Phase 4

   Every compile has a different hash

   Building the same code gave different hashes across jobs, so the official hash can't be written into the rule.

5. Phase 5

   Rules caught 2 of 10 variations at first

   Three rule fixes raised that to 5 of 10. The other misses stay on record with the reason each is hard to fix.

6. Phase 6

   4 of 11 normal scenarios stayed quiet at first

   Raising the guessing threshold silenced small LAN events, at the cost of giving a guesser 19 tries instead of 9.

7. Phase 7

   Converted rules don't always behave the same

   Elasticsearch rejected some converted queries outright, and its case-sensitive matching misses -EncodedCommand.

This project detects tampering. It contains no cracks, cheats, or bypass steps, and it never touches a real game, license service, or anti-cheat product.