Sigma detection rules, expert-reviewed

Windows: ManageEngine SupportCenter Plus msiexec.exe Dropped in bin (CVE-2021-44077 POC)

Alerts on msiexec.exe being created in the SupportCenterPlus bin folder on Windows.

Windows Office Startup Folder File Creation with Uncommon Extension

Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.

Java Payload Indicators in Web Server Logs

Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.

Windows Process Creation: Renamed msdt.exe Execution

Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

Linux Java Process Launching Suspicious Shell and Scripting Children

Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

Windows Office Startup Folder File Drop for Persistence via Office Documents

Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

Windows Office Child Process with Directory Traversal Patterns

Alerts on Office parent processes launching child commands containing directory traversal patterns.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Azure Sign-in Logs: Conditional Access Blocked Sign-in Failures (ResultType 53003)

Alerts on Azure sign-ins blocked by Conditional Access when requirements are not met.