Sigma detection rules, expert-reviewed

Azure Entra ID Identity Protection Unlikely Travel Risk Events

Alerts on unlikelyTravel risk events tied to geographically distant sign-ins and potential deviation from user travel history.

Azure RiskDetection flags riskyIPAddress from anonymous proxy IP addresses

Alerts when Azure reports user activity linked to a risky anonymous proxy IP address.

Azure Entra ID anomalous user activity risk event

Alerts on Azure AD risk events indicating anomalous user activity via riskEventType=anomalousUserActivity.

Qakbot Uninstaller Execution via QbotUninstall.exe (Windows Process Creation)

Alerts on execution of the QbotUninstall.exe uninstaller when it matches known Qakbot uninstaller hashes.

Suspicious rundll32 Single-Digit DLL Execution with DllRegisterServer on Windows

Flags rundll32.exe running 1.dll with DllRegisterServer, a pattern seen in suspicious DLL execution.

Suspicious WinRAR Child Process Execution Attempt on Windows (CVE-2023-38331)

Alerts on WinRAR spawning command/scripting child processes tied to Temp\Rar$ activity consistent with CVE-2023-38331 exploitation attempts.

Windows: WinRAR double-extension file creation with space in Temp Rar$ path

Alerts on WinRAR-created Temp Rar$ files with double extensions separated by a space on Windows.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

Windows: Local User Creation via net.exe with DarkGate and SafeMode

Alerts on net.exe adding a local user when the command line includes “DarkGate” and “SafeMode”.

Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise

Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.

Windows File Creation of wermgr.exe in Uncommon Directory (Potential CVE-2023-36874)

Alerts on wermgr.exe creation in atypical Windows directories that may indicate filename spoofing.

Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting

Flags Excel-related process command lines that disable Python function execution warnings via PythonFunctionWarnings=0.

Azure Entra ID Riskdetection: Anonymous IP Address sign-in risk events

Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Alerts when aspnet_compiler.exe runs with command lines indicating user-writable or temp/task paths.