Sigma detection rules, expert-reviewed

Azure Entra sign-in risk: Unfamiliar sign-in properties

Alerts on Azure risk events where sign-in properties are marked unfamiliar compared to a user’s historical patterns.

Azure SAML Token Issuer Anomaly via riskdetection

Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.

Azure Entra suspicious browser risk events across multiple tenants and countries

Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.

Azure Entra ID risk event: successful password spray detection

Flags Azure Entra ID risk events indicating a successful password spray attempt.

Azure Entra ID sign-in risk: new country (riskEventType newCountry)

Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.

Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses

Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.

Azure AD LeakedCredentials Risk Event Indicates User Credential Exposure

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

Azure risk event: Suspicious inbox manipulation rules that delete or move messages or folders

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

Azure Risk Event: Suspicious Inbox Forwarding

Alerts on Azure Identity Protection risk events indicating inbox forwarding to an external address.

Azure AD User Login Risk: Impossible Travel from Distant Locations

Flags Azure Entra risk events tagged as impossibleTravel indicating implausible geographic sign-in travel within a short time.

Azure Entra ID Identity Protection Unlikely Travel Risk Events

Alerts on unlikelyTravel risk events tied to geographically distant sign-ins and potential deviation from user travel history.

Azure RiskDetection flags riskyIPAddress from anonymous proxy IP addresses

Alerts when Azure reports user activity linked to a risky anonymous proxy IP address.

Azure Entra ID anomalous user activity risk event

Alerts on Azure AD risk events indicating anomalous user activity via riskEventType=anomalousUserActivity.

Suspicious Child Process Spawned by WinRAR.exe on Windows

Alerts when WinRAR.exe launches command, scripting, or proxy execution binaries on Windows.

Qakbot Uninstaller Execution via QbotUninstall.exe (Windows Process Creation)

Alerts on execution of the QbotUninstall.exe uninstaller when it matches known Qakbot uninstaller hashes.