Sigma detection rules, expert-reviewed

Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP

Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.

Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate

Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.

Windows Registry ZoneMap ProtocolDefaults Downgraded to My Computer for HTTP/HTTPS

Flags IE/Windows ZoneMap changes setting HTTP/HTTPS ProtocolDefaults DWORD 0x00000000 to the My Computer zone.

Windows Process Creation: IE ZoneMap ProtocolDefaults downgraded to My Computer for HTTP/HTTPS

Flags Windows command lines that set IE ZoneMap ProtocolDefaults for HTTP to the My Computer (zone 0) trust level.

Linux Process Creating esxcli System Permission Set Admin for an Account

Alerts when esxcli is run to set Admin permissions via the system/permission set flags.

Azure Entra sign-in risk: Unfamiliar sign-in properties

Alerts on Azure risk events where sign-in properties are marked unfamiliar compared to a user’s historical patterns.

Azure SAML Token Issuer Anomaly via riskdetection

Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.

Azure Entra suspicious browser risk events across multiple tenants and countries

Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.

Azure Entra ID risk event: successful password spray detection

Flags Azure Entra ID risk events indicating a successful password spray attempt.

Azure Entra ID sign-in risk: new country (riskEventType newCountry)

Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.

Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses

Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.

Azure AD LeakedCredentials Risk Event Indicates User Credential Exposure

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

Azure risk event: Suspicious inbox manipulation rules that delete or move messages or folders

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

Azure Risk Event: Suspicious Inbox Forwarding

Alerts on Azure Identity Protection risk events indicating inbox forwarding to an external address.

Azure AD User Login Risk: Impossible Travel from Distant Locations

Flags Azure Entra risk events tagged as impossibleTravel indicating implausible geographic sign-in travel within a short time.