Sigma detection rules, expert-reviewed

Malicious User Password Change Using Current Hash Password - ChangeNTLM - Mimikatz (via security)

This rule detects resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Suspicious Account Password Set to Never Expire. (via security)

This rule detects scenarios where an account password is set to never expire.

Malicious Modification of a Computer Account SPN (via security)

This rule detects update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.

Suspicious Massive Group Membership Changes (via security)

This rule detects will add a compromised account into different domain groups in order to gain access to all the assets under the control of those concerned groups.

Malicious High Risk Active Directory Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed.

Malicious Account Marked as Sensitive and Cannot Be Delegated Had Its Protection Removed (via security)

This rule detects removes security protection from a sensitive account to escalate privileges.

Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)

This rule detects execution of the SharpHound collector or the Invoke-BloodHound cmdlet using its characteristic collection-method arguments, which harvest Active Directory objects, sessions and access-control relationships to map attack paths to Domain Admin. Large-scale AD discovery like this is a common pre-lateral-movement step seen across intrusions in the Red Canary Threat Detection Report. Detecting the collector's invocation surfaces reconnaissance before the adversary pivots.

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Kerberos Only (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Host Set with Unconstrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Host Set with Constrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Masquerading Computer Account Manipulation for Delegation - RBCD (via security)

This rule detects manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

This rule detects bitsadmin.exe configuring a background transfer job to launch a command when it completes, using SetNotifyCmdLine or a long-lived custom job, an abuse of the Background Intelligent Transfer Service for stealthy persistence and execution. BITS abuse appears in the Red Canary Threat Detection Report as a way to survive reboots and run payloads under a trusted service. Detecting notify-command job setup surfaces the persistence mechanism.

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

This rule detects whoami being run with its output redirected into a file, a reconnaissance-and-staging behavior used by loaders such as SocGholish to capture the current user and privilege context for the operator to review. Automated whoami-to-file collection is documented in the Red Canary Threat Detection Report as an early post-compromise step. Because interactive users rarely redirect whoami output to disk, this is a useful indicator of scripted hands-on activity.

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

In-Memory AMSI or ETW Bypass in PowerShell (via process_creation)

This rule detects PowerShell command lines containing AMSI or ETW bypass constructs (AmsiScanBuffer, amsiInitFailed, System.Management.Automation.AmsiUtils or EtwEventWrite patching), which blind script scanning and telemetry so malicious code runs undetected. AMSI and ETW tampering is a defense-evasion technique highlighted in the Red Canary Threat Detection Report. Detecting these strings surfaces an attacker disabling instrumentation before executing a payload.