Sigma detection rules, expert-reviewed

Linux auditd: BPFDoor .pid or .lock file access in /var/run

Alerts on auditd-monitored access to specific /var/run .pid and .lock files associated with BPFDoor-style behavior.

Linux auditd: iptables NAT redirect execution to altered TCP destination ports

Flags iptables NAT REDIRECT commands with --to-ports values 42–43 observed via Linux auditd EXECVE.

Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account

Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.

Azure Entra: Guest User Invitation Failed When Initiated by Non-Privileged User

Identifies failed guest user invitations in Azure audit logs when the inviter lacks required permissions.

Windows Registry Persistence via MyComputer \"Default\" Value Modification

Detects changes to Explorer\MyComputer (Default) registry value that can redirect a launched binary for persistence.

Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\

Alerts on writing ErrorHandler.cmd to C:\WINDOWS\Setup\Scripts\, a persistence-relevant location on Windows.

Windows file creation for SharpHound/BloodHound collection output filenames

Flags SharpHound/BloodHound default collection export files (zip and multiple JSON datasets) from Windows file events.

Azure Entra PIM Role Setting Changes in Audit Logs

Alerts on Azure PIM role setting update events recorded in audit logs.

Azure PIM Alert Setting Disabled (Audit Log Message Detection)

Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").

Azure PIM Approval or Denial Recorded in Audit Logs

Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.

Windows SafeBoot Registry Key Deletion via reg.exe Command-Line

Flags reg.exe deleting the \SYSTEM\CurrentControlSet\Control\SafeBoot registry key via command line.

Windows mshta.exe launched with URL-based arguments (http/https/ftp)

Alerts when mshta.exe is executed with HTTP/HTTPS/FTP URLs in the command line, consistent with remote HTA execution.

Windows Registry Persistence: DbgManagedDebugger Debugger Value Added

Alerts on registry sets that add a Debugger value under DbgManagedDebugger, indicating potential crash-triggered persistence.

Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)

Alerts on Windows process launches whose Image path contains 8.3 short-name markers (~1\ or ~2\), excluding several known benign parents.

Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)

Alert on Windows command lines referencing 8.3 short paths (~1\, ~2\) that may indicate path obfuscation.