Sigma detection rules, expert-reviewed

GitHub Audit: Secret Scanning Push Protection Disabled

Alerts on GitHub audit log events where secret scanning push protection is disabled for org, repo, or custom patterns.

GitHub Audit: Secret Scanning Push Protection Bypass Event Detected

Triggers on GitHub audit events indicating a secret scanning push protection bypass attempt.

Windows Process Creation: rundll32 Shell32 Control_RunDLL Executes .CPL from User Temp

Detects rundll32 Shell32 Control_RunDLL launching a .CPL from user Temp, a stealthy execution path.

Windows Registry: SentinelOne Scan Context Menu Command Tampering by Non-SentinelOne Process

Alerts on registry modifications to SentinelOne scan context menu command entries not matching SentinelOne’s expected binary.

Windows Shell Context Menu Registry Command Tampering

Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.

Windows Utility Loads Unsigned DLL (ImageLoad)

Flags DLL loads by InstallUtil/RegAsm/RegSvcs/regsvr32/rundll32 when the loaded DLL is unsigned or untrusted.

Windows ScreenConnect Service Web Shell Execution via cmd.exe or csc.exe

Alert on ScreenConnect.Service.exe spawning cmd.exe or csc.exe, consistent with potential web shell execution on Windows.

Windows DNS Queries to update.onelaunch.com by OneLaunch.exe

Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.

AWS CloudTrail GetSigninToken Requests with Suspected Console User-Agent

Flags CloudTrail GetSigninToken sign-in token requests with non-matching console user-agent patterns.

Bitbucket Audit: User Permission Details Export Attempts

Flags Bitbucket user details export attempts in audit logs, including start, success, and failure.

Bitbucket Audit: SSH User Login Failures

Alerts on Bitbucket audit records showing SSH-based user login failures in authentication events.

Bitbucket audit: User login failed authentication events

Flags Bitbucket audit events for user login failures in the authentication category.

Bitbucket Audit: User Permissions Export Attempt Detection

Alerts on Bitbucket audit events indicating user permissions export activity (started, exported, or failed).

Bitbucket Audit: Unauthorized Full Data Export Triggered (Data Pipeline)

Flags Bitbucket audit events indicating an unauthorized user attempted a full data export.

Bitbucket Audit: Unauthorized Access to a Resource

Flags Bitbucket audit events reporting unauthorized access attempts to a resource.