Sigma detection rules, expert-reviewed

Windows: Uncommon Process Access to Microsoft Teams Cookies or Local Storage leveldb

Alerts on access to Teams Cookies or leveldb files by processes other than Teams.exe on Windows.

Windows File Access Attempt to Panther\unattend.xml During Unattended Install

Alerts on attempts to access Panther\unattend.xml on Windows, a potential source of embedded credentials.

Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification

Detects registry changes to COM CLSID Default InprocServer32/LocalServer32 values that point to suspicious locations.

Windows Process Creation: Renamed Microsoft Teams Executable Launch

Alerts when Microsoft Teams binaries are launched under renamed executable names on Windows.

Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)

Alerts when DsrmAdminLogonBehavior registry value is changed on Windows, except the default DWORD 0x00000000.

Windows Process Execution of BitLockerToGo.EXE

Alerts on Windows execution of BitLockerToGo.exe, a rarely used BitLocker To Go component for portable drive encryption.

Windows DLL Sideloading Suspected for ms<wbr>corsvc.dll via ImageLoad

Alerts on non-standard loads of msocrsvc.dll, a potential DLL sideloading opportunity on Windows.

Windows DLL Sideloading via MpSvc.dll Image Load Anomaly

Flags Windows module loads of MpSvc.dll outside typical Defender/WinSxS locations that may indicate DLL sideloading.

Potential DLL Sideloading: Image Load of DbgModel.dll on Windows

Alerts when a process loads DbgModel.dll from a non-standard path, suggesting possible DLL sideloading.

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.

AWS RDS Security Group Changes via CloudTrail

Flags CloudTrail RDS events that create, delete, or change DB security group ingress rules.

AWS CloudTrail ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups

Alerts on CloudTrail events that change ELB/ALB security groups by applying or setting load balancer security groups.

AWS CloudTrail Security Group Ingress/Egress Rule Changes

Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.

AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table

Flags CloudTrail EC2 CreateRoute events indicating a new route was added to an AWS route table.

AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules

Identifies when EC2 network ACL entries are created in AWS via CloudTrail.