Sigma detection rules, expert-reviewed

Windows Registry: Change to Services\WinSock2\Parameters\AutodialDLL for DLL Persistence

Alerts on registry changes to AutodialDLL under WinSock2 parameters that may enable DLL-based persistence.

Windows Registry App Paths Default Property Change Using Suspicious Values

Alerts on Windows App Paths registry edits to (Default)/Path with suspicious binaries, scripts, or temp/public locations.

Windows Startup Folder File Creation with Suspicious Script/Executable Extensions

Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.

Linux auditd: BPFDoor .pid or .lock file access in /var/run

Alerts on auditd-monitored access to specific /var/run .pid and .lock files associated with BPFDoor-style behavior.

Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account

Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.

Windows Registry Persistence via MyComputer \"Default\" Value Modification

Detects changes to Explorer\MyComputer (Default) registry value that can redirect a launched binary for persistence.

Windows file creation for SharpHound/BloodHound collection output filenames

Flags SharpHound/BloodHound default collection export files (zip and multiple JSON datasets) from Windows file events.

Azure Entra PIM Role Setting Changes in Audit Logs

Alerts on Azure PIM role setting update events recorded in audit logs.

Azure PIM Alert Setting Disabled (Audit Log Message Detection)

Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").

Azure PIM Approval or Denial Recorded in Audit Logs

Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.

Windows SafeBoot Registry Key Deletion via reg.exe Command-Line

Flags reg.exe deleting the \SYSTEM\CurrentControlSet\Control\SafeBoot registry key via command line.

Windows mshta.exe launched with URL-based arguments (http/https/ftp)

Alerts when mshta.exe is executed with HTTP/HTTPS/FTP URLs in the command line, consistent with remote HTA execution.

Windows Registry RDP Terminal Services Sensitive Settings Tampering

Flags Windows registry changes to sensitive RDP/Terminal Services settings such as shadowing, remote assistance, security, and InitialProgram.

Azure Audit Logs: User Added to Privileged Eligibility Role

Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.

Windows Exploit Guard Controlled Folder Access: Added Allowed Application for Blocked Path

Alerts when an app is added to Exploit Guard’s AllowedApplications list to bypass controlled folder restrictions for risky paths.