Sigma detection rules, expert-reviewed

Malicious User Properties Enumeration via Commandline (via process_creation)

This rule detects enumerate local users via commandline.

Malicious Active Directory Honeypot Enumerated by a Suspicious Host - Bloodhound (via security)

This rule detects is attempting to discover sensitive accounts using tools like Bloodhound. To find out the source of the enumeration, correlate the SubjectLogonId from ID 4662 with TargetLogonId from ID 4624.

Malicious Audit Policy Enumerated (via process_creation)

This rule detects attempts enumerate the audit policy in place.

Renamed Account Renamed to Admin (or Likely) Account to Evade Defense (via security)

This rule detects rename a non admin account in order to evade SOC & operations vigilance.

Malicious Azure Windows Virtual Machine Login via Serial Console (via security)

This rule detects if an attacker logs on using the serial console.

Suspicious System Time Changed - PowerShell (via powershell)

This rule detects change the system time to evade defense.

Malicious Event Log Clear Attempt - PowerShell (via powershell)

This rule detects clear the event logs.

Suspicious Massive SAM Users/groups Enumeration - Native (via security)

This rule detects enumerate sensitive domain users/groups settings and membership. Correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.

Malicious Local Group Enumeration Triggered by Azure Virtual Machine Recovery Tool (via security)

This rule detects having compromised a virtual machine via serial cable attempts to enumerate local groups.

Malicious Serial Console Process Spawning CMD Shell - Via Command (via process_creation)

This rule detects if an attacker open a privileged CMD shell while accessing to an Azure virtual machine via serial cable.

Malicious Fortinet APT Group Abuse on Windows - Task (via security)

This rule detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.

Suspicious File with High Volume Downloaded via BITS (via bits)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Malicious WMI Module Loaded by Suspicious Process (via image_loaded)

This rule detects load WMI modules from a suspicious process (like PowerShell).

Malicious Active Directory Honeypot Used for Lateral Movement (via security)

This rule detects is using.

WinRS Usage for Remote Execution (via process_creation)

This rule detects abuses the WinRS capacities for remote execution.