Sigma detection rules, expert-reviewed

Linux Process Creation: ESXi User Account Added via esxcli system account add

Alerts when esxcli is used to run an ESXi system account add command, indicating user account creation.

Azure Entra ID Riskdetection: Anonymous IP Address sign-in risk events

Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.

Windows Process Execution Triggered from WebDAV LNK Paths

Alerts on explorer.exe launching cmd/cscript/mshta/powershell/wscript/pwsh when the command line references a WebDAV \DavWWWRoot\ LNK path.

Windows WebDAV Temporary File Creation with Suspicious Extensions

Flags creation of WebDAV temporary files on Windows in a Tfs_DAV temp path with executable/archive-like extensions.

Windows Registry: New BgInfo UserFields value enabling custom WMI query execution

Alerts on new BgInfo UserFields registry entries that appear to configure a custom WMI query.

Windows Registry: New BgInfo UserFields value enabling custom VBScript execution

Detects registry changes under BgInfo UserFields that can be configured to run custom VBScript via BgInfo.exe.

Windows Registry Set: New BgInfo Database Path Value

Detects registry writes under BgInfo database configuration that set a new external database path.

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Windows Bash.exe Launched Without Script Execution Arguments

Alerts on bash.exe launched without script-execution flags, a potential stealthy way to run bash-driven payloads on Windows.

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Alerts when aspnet_compiler.exe runs with command lines indicating user-writable or temp/task paths.

Suspicious Child Process of aspnet_compiler.exe on Windows

Alerts when aspnet_compiler.exe spawns calc/notepad or executes from public/temp/Task-related paths on Windows.

Windows: Detect aspnet_compiler.exe Creating Temporary Assembly DLLs

Alerts when aspnet_compiler.exe writes a new DLL into the Temporary ASP.NET assembly tmp directories.

Windows DLL sideloading via unsigned mfdetours.dll loaded by image_load

Alerts on loading unsigned \mfdetours.dll, consistent with DLL sideloading abuse via mftrace.exe.

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.

Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe

Flags Gpg4win (gpg.exe/gpg2.exe) executions using passphrase-based encryption on Windows.