Sigma detection rules, expert-reviewed

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Windows dllhost.exe Launched With No Command-Line Arguments

Alerts on dllhost.exe being executed with no command-line arguments, a rare pattern that may indicate stealthy or injected activity.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.

Windows WerFault LSASS Memory Dump File Creation

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

Windows: Potential Process Injection via Msra.exe Spawning Suspicious Child Processes

Flags Msra.exe spawning suspicious tools that may indicate process injection or post-exploitation activity on Windows.

Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

Linux Shell History File Deletion via rm/unlink/shred

Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.

Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider

Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.

Windows: Chromium-Based Browser Launched via Script Host with --load-extension

Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.

Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)

Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

Azure AD Sign-ins Using Legacy Authentication Client Applications

Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.