Sigma detection rules, expert-reviewed

Microsoft Exchange ProxyToken Exploitation via ECP POST and InboxRules NewObject (CVE-2021-33766)

Flags POSTs to Exchange ECP InboxRules endpoints with SecurityToken= that return HTTP 500, indicating ProxyToken exploitation attempts.

Windows Process Creation Matching TrustedPath UAC Bypass Directory Mocking Strings

Alerts on Windows processes referencing System32/SysWOW64 paths consistent with TrustedPath UAC bypass directory mocking.

Exchange Management: Removal of Mailbox Export Request via Remove-MailboxExportRequest

Detects Exchange management removals of mailbox export requests using Remove-MailboxExportRequest with Confirm set to "False".

Windows Security: Suspicious Registry Access to ADHealthAgent Health Service Agent Keys

Detects non-standard processes accessing HKLM\SOFTWARE\Microsoft\ADHealthAgent registry key activity in Windows security logs.

Windows Security: Access to Azure AD Health Monitoring Agent Registry Key

Flags suspicious access to the Azure AD Health Monitoring Agent registry key using Windows Security 4656/4663.

Google Workspace: Admin audit events where strong authentication is allowed without enforcement (MFA disabled)

Alerts on Google Workspace admin changes that set strong authentication/MFA enforcement to false.

Google Workspace Admin: Application Removed from Domain

Flags Google Workspace domain events indicating an application was removed, including allowlist/whitelist removal.

Azure AD Hybrid Health AD FS Service Deletion via Azure Activity Logs

Flags Azure AD Hybrid Health AD FS service deletions from Azure Activity Logs under the Administrative category.

Azure Activity Logs: AD Hybrid Health AD FS server instance create/update

Alerts on Administrative Azure Activity Log events adding/updating AD Hybrid Health AD FS service member servers.

MODX Manager Path Traversal Attempt via tvs.php class_key (CVE-2010-5278)

Alerts on HTTP requests to MODx tvs.php with traversal-based class_key payload indicative of LFI attempts.

Google Workspace Admin: Detect Role Privilege Deletion (REMOVE_PRIVILEGE)

Triggers on Google Workspace role privilege removal events (REMOVE_PRIVILEGE) in Admin audit logs.

Google Workspace Admin Role Modified or Deleted via admin.googleapis.com Audit Events

Identifies Google Workspace role updates, renames, or deletions from admin.googleapis.com audit events.

Web Exploitation of Arcadyan Router Path Traversal and Config Injection Attempts

Detects Arcadyan router exploit traffic by matching URL-encoded path traversal patterns in query strings linked to config injection.

Windows Registry UAC Bypass Attempt via Windows Media Player osk.exe AppCompatFlags

Identifies registry AppCompatFlags entries for Windows Media Player osk.exe that may indicate a UAC bypass attempt.

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.