Sigma detection rules, expert-reviewed

Advanced IP Scanner Execution from Temp Folder via Windows File Events

Flags file activity targeting Advanced IP Scanner 2 under a Windows user Temp directory.

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations

Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.

Azure Activity Logs: Granting Role Assignments from New Source IPs

Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.

Azure Activity Logs: High Rate of VM Creations or Deployment Writes

Flags Azure activity log events showing VM creation or deployment write operations occurring at an anomalously high volume.

Windows Security Log: Metasploit SMB NTLM Logon (4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

Windows Failed Logon (Event ID 4625) From Non-Private Public IP

Alerts on Windows failed logons (4625) originating from IPs outside private/local ranges.

Windows Fax Service ualapi.dll Side-Loading via fxssvc.exe

Flags fxssvc.exe loading ualapi.dll from unexpected paths, indicating potential DLL side-loading for privilege escalation.

Windows AppCompatFlags Store New Application Registry Entries

Alerts on new writes to the AppCompat Compatibility Assistant store registry path, indicating first-time application behavior.

Windows Registry Deletion of Shell Open Command COM Hijacking Key Paths

Flags registry deletions of \shell\open\command paths that may indicate removal of COM hijacking execution entries.

Windows sdclt.exe Spawned with High Integrity (Possible UAC Bypass)

Alerts on sdclt.exe launching as High integrity, indicating possible elevated execution consistent with UAC bypass attempts.

Windows Process Creation: .NET ETW Logging Environment Variables Set via Command Line

Flags process command lines setting COMPlus_ETWEnabled/COMPlus_ETWFlags, potentially impairing ETW logging for .NET.

Windows sdclt.exe Child Process Creation

Alerts when sdclt.exe launches a child process, a behavior consistent with abused Windows binaries in escalation chains.

Windows rundll32 WebDAV Client Execution (davclnt.dll DavSetCookie)

Flags svchost.exe spawning rundll32.exe to run davclnt.dll,DavSetCookie, consistent with WebDAV client execution.