Sigma detection rules, expert-reviewed

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

Linux Java Process Launching Suspicious Shell and Scripting Children

Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

Windows Office Startup Folder File Drop for Persistence via Office Documents

Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

Windows Office Child Process with Directory Traversal Patterns

Alerts on Office parent processes launching child commands containing directory traversal patterns.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Azure Sign-in Logs: Conditional Access Blocked Sign-in Failures (ResultType 53003)

Alerts on Azure sign-ins blocked by Conditional Access when requirements are not met.

Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.

Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download

Alerts on registry settings that redirect OneDrive update URL retrieval from UpdateOfficeConfig for internet downloads.

Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

Alerts when PowerShell command lines contain encoded obfuscation patterns referencing Net.Webclient with anomalous casing.

Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.