Sigma detection rules, expert-reviewed

Windows: Uncommon Child Processes Spawned by Addinutil.exe

Alerts when Addinutil.exe launches an uncommon child process, indicating potential proxy execution abuse.

Windows AddInUtil.exe Executed with Suspicious AddInRoot or PipelineRoot Parameters

Alerts on AddInUtil.exe runs using uncommon AddInRoot/PipelineRoot values targeting Temp, Desktop, Downloads, or public user paths.

Windows network connections initiated by AddinUtil.exe

Alerts on network connections initiated by Addinutil.exe, which is uncommon for this utility on Windows.

Microsoft 365 Audit: New Federated Domain Added

Alerts on Microsoft 365 audit events indicating a new federated domain was added.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Windows: Diskshadow.exe Script Mode Execution from Suspicious File Paths

Alerts when diskshadow.exe runs with /s and a script path found in Temp/AppData/ProgramData/Users\Public-style directories.

Windows Diskshadow Script Mode Executes Script File with Uncommon .txt Extension

Alerts when diskshadow.exe runs with -s script mode and the script path/command includes an uncommon extension like .txt.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Windows Diskshadow.exe Child Process Execution

Alerts when Diskshadow.exe is the parent process of a newly created process on Windows.

Windows File Access to .reg and .hive Backups by Uncommon Applications

Alerts on access to .hive/.reg files from less-common application paths on Windows.

Azure Entra PIM Alerts: Too Many Global Administrators Assigned to Tenant

Alerts when Azure PIM reports an overabundance of Global Administrator role assignments in a tenant.

Azure AD PIM Redundant Assignment Alert When Privileged Role Not Used

Alerts on Azure PIM redundant privileged role assignments where the assigned role appears unused.

Azure PIM Role Activation Without MFA Alert (noMfaOnRoleActivationAlertIncident)

Alerts when Azure PIM signals role activation occurred without MFA.

Azure AD PIM Role Activations Too Frequent for Same User

Alerts when Azure PIM logs sequential activation renewals for the same role by the same user.

Azure PIM Alert: Privileged Role Assigned Outside PIM

Detects Azure PIM risk events indicating privileged role assignments were made outside PIM.