Sigma detection rules, expert-reviewed

Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps

Alerts on successful Cloud App Security reports of data exfiltration attempts using unsanctioned apps.

Microsoft Cloud App Security: Alerts for Successful Activity from Infrequent Countries

Alerts on successful Microsoft Cloud App Security anomaly events for activity from countries not recently visited by your users.

M365 Threat Management: Activity from Anonymous Proxy IP Addresses

Alerts when Microsoft 365 threat management reports successful activity from IPs marked as anonymous proxies.

Microsoft Cloud App Security Activity by Terminated Azure AD User

Alerts on successful "Activity performed by terminated user" events where a terminated Azure AD account still shows activity.

Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs

Alert on successful Cloud App Security activity events tied to IPs marked risky by Microsoft Threat Intelligence.

Google Workspace Admin API: User Granted Admin Privileges

Flags Google Workspace audit events where a user is granted delegated or admin privileges in the tenant.

Google Workspace Admin API Client Authorization Granted to Service Accounts

Identifies Google Workspace domain-level authorization of an API client via admin.googleapis.com audit events.

Windows: Suspicious explorer.exe Child Process Spawned by RazerInstaller.exe

Flags explorer.exe spawned by RazerInstaller.exe when the installer runs at System/high integrity.

Zeek DCE/RPC: Remote Print Driver or Print Processor Installation Activity

Alerts on Zeek DCE-RPC RPC operations that remotely add printer drivers or print processors.

Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules

Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.

PowerShell Write-Hijack HackTool Creates .bat for DLL Hijack Execution (Windows)

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

Windows: Detect reg.exe Changing Screen Saver Registry Settings for .scr Payloads

Flags reg.exe command lines that modify HKCU desktop screensaver settings and configure a .scr screen saver payload.

PowerShell WMI Event Subscription Persistence via New-CimInstance

Finds PowerShell creating WMI __EventFilter and CommandLineEventConsumer objects for event-triggered persistence.

Zeek DNS Queries Ending in Known Crypto Mining Pool Domains

Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.

Microsoft 365 SecurityComplianceCenter: User Restricted From Sending Email

Alerts when Microsoft 365 SecurityComplianceCenter reports a user was successfully restricted from sending email due to sending-limit policy violations.