Sigma detection rules, expert-reviewed

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.

Windows Security Event 4697: HybridConnectionManager Service Installation

Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Detects Outlook macro warning bypass by setting the Outlook security level registry value to enable all macros.

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Alerts on enabling the Outlook LoadMacroProviderOnBoot registry setting, which can allow automatic VBA module loading at startup.

Windows: New Outlook VBAProject OTM Macro File Created

Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.

Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

Detects Exchange Management changes to OAB ExternalUrl containing script indicators and Page_Load.

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Alerts on schtasks.exe commands that create one-time scheduled tasks referencing a Temp directory.

Windows: Suspicious Service Binary Executed from Public/System Directories

Alerts on service-hosted processes executing from user/public or system-writable directories on Windows.

Windows Process Creation: Exchange Server Artifact Discovery and File Staging Patterns

Alerts on Exchange-focused suspicious Windows command-line activity involving dumping, temp file creation, and compression utilities.

Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

Flags registry persistence where script payload indicators like vbscript: and RunHTMLApplication appear in set registry values.

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.