Sigma detection rules, expert-reviewed

Azure AuditLogs: Privileged role assignment to user access admin

Flags Azure AuditLogs events where a user is assigned to User Access Administrator, enabling full subscription management.

Azure Activity Logs: Authorization ElevateAccess Grants Subscription-Level Management

Alerts on Azure Activity Log authorization elevation actions that can grant access to manage all subscriptions.

Windows PowerShell Clears Console History via Clear-History

Flags PowerShell attempts to clear or delete console/PSReadline command history to hinder command forensics.

Windows: Rundll32 Loading shell32.dll via Control_RunDLL from User/Temp Paths

Alerts on rundll32.exe loading shell32.dll with Control_RunDLL from AppData/Temp/user paths.

Windows CertReq -Post Download Attempt via HTTP

Flags certreq.exe executions using -Post -config and HTTP content retrieval indicators.

Windows PsExec/PAExec Command-Line Flags Escalating to LOCAL SYSTEM

Flags in PsExec/PAExec command lines requesting LOCAL SYSTEM execution are matched via process creation command-line telemetry.

Windows MSIInstaller EventID 1033 PoC File Takeover String Match (InstallerFileTakeOver/CVE-2021-41379)

Alert on Windows MSI installer EventID 1033 with event data containing 'test pkg', consistent with PoC activity for CVE-2021-41379.

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Sitecore Pre-Auth RCE (CVE-2021-42237) exploitation attempts via Report.ashx POST

Alerts on successful HTTP POST traffic targeting Sitecore Reporting Report.ashx associated with CVE-2021-42237.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.