Sigma detection rules, expert-reviewed

Azure Activity Logs: Kubernetes ClusterRole/Role Write, Delete, Bind, or Escalate Changes

Alerts on Azure Kubernetes RBAC Role/ClusterRole writes, deletions, bind, or escalation actions in activity logs.

Azure Activity Logs: Kubernetes Network Policy Write/Delete Changes

Alerts on Azure Activity Log events that modify or remove Kubernetes network policies for connected clusters.

Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted

Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.

Azure Activity Logs: Container Registry Created or Deleted

Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.

Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)

Flags Exchange web requests with ProxyShell-like /autodiscover.json query patterns and PowerShell/EWS-related parameters, often returning HTTP 401.

Windows AnyDesk Silent Installation via Command-Line Flags

Identifies AnyDesk being silently installed on Windows using --install, --start-with-win, and --silent command-line flags.

Windows esentutl Usage with /p Flag for Credential Access

Flags Windows executions of esentutl when used with the /p parameter to access credentials-related files.

Windows Registry: Tamper Protection Disabled in Microsoft Defender Features

Flags registry changes that set Microsoft Defender Tamper Protection to disabled (DWORD 0x0), excluding expected MsMpEng update activity.

Windows Registry: Disabling Windows Defender PUA Protection via PUAProtection DWORD

Flags registry changes that set Windows Defender PUAProtection DWORD to 0x00000000 to disable PUA protection.

Windows Registry: Disable Windows Defender Exploit Guard Network Protection via Policy Override

Alerts on registry policy changes that override Exploit Guard Network Protection settings for Windows Defender.

Windows process access matching Cobalt Strike BOF injection call trace

Flags suspicious Windows process access consistent with CobaltStrike BOF injection using ntdll/KERNELBASE call traces and high GrantedAccess.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse

Identifies Windows processes with command-line arguments consistent with ADCSPwn targeting ADCS and a specified port.

Windows Process Creation: Recon Data Export via Command Prompt Redirection

Alerts when recon-related Windows utilities are launched with command-line output redirected to temp locations.