Sigma detection rules, expert-reviewed

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication

Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Sign-In Logs: Device Registration or Join Success Without MFA

Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Azure Audit Logs: BitLocker Key Read Activity

Alerts on Azure audit events reading BitLocker keys, which can enable recovery and encryption bypass.

Windows dllhost.exe Launched With No Command-Line Arguments

Alerts on dllhost.exe being executed with no command-line arguments, a rare pattern that may indicate stealthy or injected activity.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.

Windows WerFault LSASS Memory Dump File Creation

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

Windows: Potential Process Injection via Msra.exe Spawning Suspicious Child Processes

Flags Msra.exe spawning suspicious tools that may indicate process injection or post-exploitation activity on Windows.

Windows DNS Queries Containing ufile.io Domain

Alerts on Windows DNS lookups where the queried name contains ufile.io, indicating potential exfiltration-related activity.

Windows Process Execution: msdt.exe Launched with -cab Flag

Alerts when msdt.exe is started with the "-cab" argument, consistent with suspicious cabinet-based diagcab usage.

Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

Flags PowerShell script blocks invoking TroubleshootingPack with unattended answer-file arguments.

Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering

Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.