Sigma detection rules, expert-reviewed

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

Azure AD: Application Owner Added via Audit Log Message

Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.

Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

Windows Office Child Process with Directory Traversal Patterns

Alerts on Office parent processes launching child commands containing directory traversal patterns.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

Windows msdt.exe Execution with Suspicious Parent Process

Alerts when msdt.exe runs under common command-and-script or utility parent processes on Windows.

Windows Process Creation: wfc.exe Execution for Workflow Command-line Compiler Abuse

Alerts on execution of wfc.exe by matching process image and OriginalFileName in Windows process creation logs.

VisualUiaVerifyNative.exe Execution on Windows

Alerts when VisualUiaVerifyNative.exe is launched on Windows, a potential application-control bypass binary.

Azure Sign-in Logs: Conditional Access Blocked Sign-in Failures (ResultType 53003)

Alerts on Azure sign-ins blocked by Conditional Access when requirements are not met.

Azure AD Sign-in Logs: Detect ROPC Authentication Flow Use in Application Sign-ins

Flags Azure AD sign-ins where the message indicates an application is using the ROPC authentication flow.

Azure Sign-in Logs: OAuth Device Code Flow Usage Detected

Alerts on Azure sign-in events showing "Device Code" usage by applications outside expected input-constrained device contexts.

Windows Registry: Custom URL Protocol Handler Persistence via HKCR\ Protocol Registration

Alerts on HKCR registry set activity registering a new custom URL protocol handler, excluding Microsoft-style ms- protocols.

Windows msdt.exe / ms-msdt Handler Arbitrary Command Execution Attempts

Alerts on Windows executions of msdt.exe with command-line indicators suggesting arbitrary command execution.

Windows Registry: OneDriveStandaloneUpdater.exe URL From UpdateOfficeConfig for Proxy Download

Alerts on registry settings that redirect OneDrive update URL retrieval from UpdateOfficeConfig for internet downloads.

PowerShell: Signed UtilityFunctions.ps1 Loading Managed DLL via Proxy Execution

Flags PowerShell command lines referencing UtilityFunctions.ps1 with RegSnapin usage consistent with managed DLL proxy execution.