Sigma detection rules, expert-reviewed

Windows BITS Transfer Job Download to Suspicious File Paths

Flags new Windows BITS transfer jobs that save downloaded files into predefined suspicious paths.

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Windows dllhost.exe Launched With No Command-Line Arguments

Alerts on dllhost.exe being executed with no command-line arguments, a rare pattern that may indicate stealthy or injected activity.

WerFault lsass.exe access indicating credential dumping attempts on Windows

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.

Windows WerFault LSASS Memory Dump File Creation

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

Windows: Potential Process Injection via Msra.exe Spawning Suspicious Child Processes

Flags Msra.exe spawning suspicious tools that may indicate process injection or post-exploitation activity on Windows.

Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

Linux Shell History File Deletion via rm/unlink/shred

Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.

Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider

Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.

Windows: Chromium-Based Browser Launched via Script Host with --load-extension

Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.

Windows File Creation: Suspicious Double-Extension Filenames Ending in Script/Archive/Executable Types

Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.