Sigma detection rules, expert-reviewed

Suspicious Entra ID Password Spraying via ROPC Grant to Azure CLI App

This rule detects Entra ID authentication attempts using the Resource Owner Password Credential (ROPC) flow against the token endpoint while impersonating the well-known Azure CLI first-party application. Reported by Huntress, adversaries abuse ROPC because it submits username and password directly and can bypass interactive MFA prompts, making it a favored vector for password spraying. Detecting non-interactive ROPC grants tied to the Azure CLI app surfaces credential-guessing campaigns before account takeover.

Suspicious Entra ROPC Password Spray Against Azure CLI Client

This rule detects Entra ID sign-ins using the Resource Owner Password Credential flow against the Azure CLI application, matching the LSHIY password spray campaign. The ROPC flow submits usernames and passwords directly and cannot satisfy interactive MFA, making it a favored channel for spraying against tenants with conditional access gaps. Repeated ROPC attempts against Azure CLI indicate automated credential guessing.

Possible Illicit Consent Grant to OAuth Application via Azure AD

This rule detects a user or admin consent grant to an OAuth service principal, a technique used in the illicit consent grant attacks documented by Huntress. Adversaries lure victims into consenting to attacker-controlled applications to obtain long-lived access tokens for mail and directory data. Because legitimate app consent is common, this detection is best paired with anomalous application naming or reply URLs and treated as a hunting lead.

Suspicious Device Code Authentication via Microsoft Authentication Broker

This rule detects device code authentication requests targeting the Microsoft Authentication Broker application, identified by its client identifier 29d9ed98-a469-4536-ade2-f981bc1d605e, which attackers abuse to obtain a Primary Refresh Token during device code phishing. A stolen PRT provides broad, durable access to the victim tenant. This combination is a high-confidence indicator of an OAuth device code phishing attack.

Malicious Consent to Known Traitorware Mail Clients via Azure AD

This rule detects tenant consent grants to the eM Client and SuperMailer applications abused as traitorware in the Huntress Microsoft 365 compromise. Attackers register these legitimate desktop mail apps as service principals to retain covert access to victim mailboxes, so consent to them in an unmanaged tenant is a strong persistence signal.

Suspicious ASP.NET ViewState Deserialization Failure Event During Gladinet Exploitation

This rule detects ASP.NET ViewState validation and deserialization failure event 1316 which was observed being generated during exploitation of the Gladinet CentreStack and Triofox cryptography vulnerability. A burst of these events on an internet-facing server can indicate an attacker probing or abusing a forged ViewState to achieve deserialization-based code execution. Correlate with subsequent process creation from the IIS worker process to confirm compromise.

Possible Apache ActiveMQ RCE via Jolokia addNetworkConnector (via webserver)

This rule detects HTTP requests to the ActiveMQ Jolokia API that invoke the addNetworkConnector broker operation with a remote xbean configuration URI. This corresponds to CVE-2026-34197 remote code execution where the broker loads an attacker hosted Spring bean. Administrators rarely add network connectors that reference external HTTP xbean configs.

Possible LiteLLM Unauthenticated Command Execution via MCP Test Endpoints (via webserver)

This rule detects unauthenticated HTTP POST requests to the LiteLLM MCP test connection and tools list endpoints which accept a server configuration whose command is spawned as a subprocess. This corresponds to CVE-2026-42271 chained with a Host header authentication bypass. External access to these administrative endpoints warrants review.

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

This rule detects HTTP requests to the anonymous osTicket open, view, or account endpoints that carry a PHP filter chain such as a php filter wrapper with base64 or iconv conversions. This corresponds to CVE-2026-22200 which abuses filter chains for arbitrary file read and code execution. Ordinary ticket submissions do not contain filter wrappers.

Possible Oracle Identity Manager Authentication Bypass via WADL Suffix (via webserver)

This rule detects HTTP requests to Oracle Identity Manager iam REST endpoints that append a metadata suffix such as a WADL or WSDL marker to bypass authentication. This corresponds to CVE-2025-61757 which grants unauthenticated access to privileged REST services. Normal clients do not append these suffixes to governance paths.

Possible SolarWinds Web Help Desk Deserialization via JNDIConnectionPool Gadget (via webserver)

This rule detects HTTP requests to the SolarWinds Web Help Desk WebObjects handler that carry the JSONRPC whitelist bypass parameter or a JNDIConnectionPool deserialization gadget referencing an LDAP path. This corresponds to CVE-2025-40551 exploitation. Legitimate help desk traffic does not include these gadget markers.

Possible Langflow Unauthenticated Code Execution via validate code Endpoint (via webserver)

This rule detects HTTP POST requests to the Langflow validate code API that contain Python execution markers such as exec or import decorators. This corresponds to CVE-2025-3248 which allows unauthenticated remote code execution. Routine validation traffic does not embed decorator based exec payloads.

Possible Ivanti Cloud Services Appliance Command Injection via datetime.php (via webserver)

This rule detects HTTP POST requests to the Ivanti Cloud Services Appliance datetime.php endpoint that carry the TIMEZONE parameter together with shell metacharacters. This pattern corresponds to exploitation of CVE-2024-8190 where attacker input reaches an operating system command. Benign timezone configuration does not include command separators.

Suspicious PHP File Written to FreePBX Custom Firmware Directory (via file_event)

This rule detects creation of a PHP file inside the FreePBX tftpboot custom firmware directory. The CVE-2025-57819 file upload flaw drops PHP webshells to this path which normally holds only firmware binaries. A PHP file in this location indicates webshell deployment.

Suspicious Run Key Persistence With Masqueraded System Binary by Millenium RAT (via registry_set)

This rule detects a CurrentVersion Run key pointing to a binary named svchost.exe or MsEdgeUpdate.exe located under a user-writable AppData, Temp, or Public path, matching the Millenium RAT persistence and masquerading technique. Legitimate copies of these binaries never run from those locations, so the wrong path plus a trusted name is a strong tell. Detecting it exposes RAT persistence.