Sigma detection rules, expert-reviewed

Linux Python Spawning Pseudo-Terminal via pty Module

Flags Linux executions where Python imports the pty module and calls spawn to create a pseudo-TTY session.

Linux chmod Process Commandlines Targeting Sensitive Directory Paths

Flags Linux chmod commands that modify permissions for paths under /tmp/, /.Library/, /etc/, or /opt/, excluding several known benign package-maintenance patterns.

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

Windows Process Creation: Remote.exe Execution

Alerts on execution of remote.exe on Windows, which can be abused via a WinDbg/SDK binary for stealthy remote execution.

Windows Process Execution of F# Interpreters (Fsi.exe, FsiAnyCpu.exe)

Flags execution of F# interpreter binaries fsi.exe and fsianycpu.exe on Windows.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Windows Office Startup Folder File Drop for Persistence via Office Documents

Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

Azure AD: Application Owner Added via Audit Log Message

Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.

Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

Windows Office Child Process with Directory Traversal Patterns

Alerts on Office parent processes launching child commands containing directory traversal patterns.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Windows Process Creation: wfc.exe Execution for Workflow Command-line Compiler Abuse

Alerts on execution of wfc.exe by matching process image and OriginalFileName in Windows process creation logs.