Sigma detection rules, expert-reviewed

Windows BITSAdmin Downloads from File-Sharing Domains

Alerts on BITSAdmin downloads from popular file-sharing domains when transfer/create/addfile command-line flags are present.

Windows Process Creation: bitsadmin Download Using Direct IP URL

Alerts when bitsadmin.exe is used to download via a direct IP address in the command line on Windows.

Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Flags attrib.exe usage with +s to mark .exe/.dll and script files in public/temp/user-writable locations as system files.

PowerShell Disable or Remove ETW Trace Sessions

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

Windows BITS Transfer Job Download to Suspicious File Paths

Flags new Windows BITS transfer jobs that save downloaded files into predefined suspicious paths.

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication

Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Sign-In Logs: Device Registration or Join Success Without MFA

Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Azure Audit Logs: BitLocker Key Read Activity

Alerts on Azure audit events reading BitLocker keys, which can enable recovery and encryption bypass.

Windows dllhost.exe Launched With No Command-Line Arguments

Alerts on dllhost.exe being executed with no command-line arguments, a rare pattern that may indicate stealthy or injected activity.

WerFault lsass.exe access indicating credential dumping attempts on Windows

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.