Sigma detection rules, expert-reviewed

Azure Audit Logs: Privileged Account Creation via Admin Role Assignment

Flags successful events where a user is added and added to a role, indicating new admin account creation in Azure.

Azure AD Account Created and Deleted Shortly After Creation (Audit Logs)

Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.

Windows Registry: Change to Services\WinSock2\Parameters\AutodialDLL for DLL Persistence

Alerts on registry changes to AutodialDLL under WinSock2 parameters that may enable DLL-based persistence.

Windows Registry App Paths Default Property Change Using Suspicious Values

Alerts on Windows App Paths registry edits to (Default)/Path with suspicious binaries, scripts, or temp/public locations.

Windows Startup Folder File Creation with Suspicious Script/Executable Extensions

Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.

Linux auditd: BPFDoor .pid or .lock file access in /var/run

Alerts on auditd-monitored access to specific /var/run .pid and .lock files associated with BPFDoor-style behavior.

Linux auditd: iptables NAT redirect execution to altered TCP destination ports

Flags iptables NAT REDIRECT commands with --to-ports values 42–43 observed via Linux auditd EXECVE.

Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account

Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.

Azure Entra: Guest User Invitation Failed When Initiated by Non-Privileged User

Identifies failed guest user invitations in Azure audit logs when the inviter lacks required permissions.

Windows Registry Persistence via MyComputer \"Default\" Value Modification

Detects changes to Explorer\MyComputer (Default) registry value that can redirect a launched binary for persistence.

Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\

Alerts on writing ErrorHandler.cmd to C:\WINDOWS\Setup\Scripts\, a persistence-relevant location on Windows.

Windows file creation for SharpHound/BloodHound collection output filenames

Flags SharpHound/BloodHound default collection export files (zip and multiple JSON datasets) from Windows file events.

Azure Entra PIM Role Setting Changes in Audit Logs

Alerts on Azure PIM role setting update events recorded in audit logs.

Azure PIM Alert Setting Disabled (Audit Log Message Detection)

Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").

Azure PIM Approval or Denial Recorded in Audit Logs

Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.