Sigma detection rules, expert-reviewed

Windows: Unusual Process Tree for wab.exe and wabmig.exe

Alert on abnormal parent/child process relationships involving wab.exe and wabmig.exe in Windows process creation logs.

Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths

Alerts when wab.exe or wabmig.exe run from unexpected directories on Windows.

Windows: User Added to Local Administrators Group via Net or Add-LocalGroupMember

Flags Windows command lines that add a user to the local administrators group via net.exe or Add-LocalGroupMember.

Windows: findstr.exe LSASS keyword matching for process reconnaissance

Alert on find.exe/findstr.exe command lines containing "lsass", indicating potential LSASS-focused reconnaissance.

Windows file write events where executables save files with suspicious script/binary extensions

Alerts when common Windows system executables write files ending in suspicious extensions like .ps1, .bat, .vbs, or .hta.

Windows Malicious iphlpapi.dll Dropped in OneDrive/Teams AppData Directory

Flags creation of iphlpapi.dll in the Microsoft AppData area used by OneDrive/Teams, consistent with DLL sideloading attempts.

Windows File Creation Time Altered to a Previous Year

Alerts on Windows events where a file’s creation time is altered to a different year, excluding common benign system/update tooling.

Webserver POST to SAAS/jersey manager API migrate tenant (Workspace ONE Access RCE pattern)

Alerts on POST requests to the Workspace ONE Access tenant migration API endpoint associated with CVE-2022-31659.

Webserver URI Probe for Workspace ONE Access Auth Bypass Attempt (CVE-2022-31656)

Alerts on webserver requests to Workspace ONE Access containing a URI query pattern linked to CVE-2022-31656 exploitation.

Windows Service Installation of AnyDesk Software (Service Control Manager 7045)

Flags Windows service creation where AnyDesk appears in the service name and ImagePath via SCM Event ID 7045.

Azure Audit Logs: Privileged Account Creation via Admin Role Assignment

Flags successful events where a user is added and added to a role, indicating new admin account creation in Azure.

Azure AD Account Created and Deleted Shortly After Creation (Audit Logs)

Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.

Windows Registry: Change to Services\WinSock2\Parameters\AutodialDLL for DLL Persistence

Alerts on registry changes to AutodialDLL under WinSock2 parameters that may enable DLL-based persistence.

Windows Registry App Paths Default Property Change Using Suspicious Values

Alerts on Windows App Paths registry edits to (Default)/Path with suspicious binaries, scripts, or temp/public locations.

Windows Startup Folder File Creation with Suspicious Script/Executable Extensions

Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.