Sigma detection rules, expert-reviewed

Azure Activity Logs: Kubernetes CronJob or Job Write Operations

Detects Azure Activity Log write operations for Kubernetes CronJobs and Jobs that can schedule container workloads.

Windows MSIInstaller EventID 1033 PoC File Takeover String Match (InstallerFileTakeOver/CVE-2021-41379)

Alert on Windows MSI installer EventID 1033 with event data containing 'test pkg', consistent with PoC activity for CVE-2021-41379.

Windows Process Creation: cmd.exe Spawned from Edge Elevation Service (CVE-2021-41379)

Alerts when cmd.exe or PowerShell spawns under Edge elevation service with SYSTEM integrity, consistent with CVE-2021-41379 exploitation.

Windows MSI Exec Creates elevation_service.exe Under Edge Path (CVE-2021-41379)

Flags msiexec creating elevation_service.exe within the Microsoft Edge application directory, indicating potential LPE exploitation.

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

macOS: Process commands with trailing space in filename to evade matching

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Linux wget POST-file Usage Indicating Data Exfiltration

Alerts on Linux wget commands using --post-file= to upload local files, indicating potential data exfiltration.

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Sitecore Pre-Auth RCE (CVE-2021-42237) exploitation attempts via Report.ashx POST

Alerts on successful HTTP POST traffic targeting Sitecore Reporting Report.ashx associated with CVE-2021-42237.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.