Sigma detection rules, expert-reviewed

Suspicious Peach Sandstorm Entra ID and ARM Enumeration via AzureHound or Roadtools (via process_creation)

This rule detects execution of cloud directory enumeration tooling such as AzureHound and Roadtools roadrecon. Peach Sandstorm ran these tools to enumerate Entra ID and Azure Resource Manager objects during discovery for follow-on intelligence collection.

Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to a file. Flax Typhoon dumped these hives to extract local account password hashes for offline cracking and credential access.

Malicious PipeMagic Named Pipe Created for Modular Backdoor Communication

This rule detects creation of a named pipe following the PipeMagic pattern where the pipe name begins with 1. followed by a hexadecimal bot identifier. Microsoft documented this pipe naming convention as core to the PipeMagic modular backdoor for inter-module messaging. The distinctive numeric prefix is not used by legitimate software, so a matching pipe indicates the backdoor is active.

Suspicious Code of Conduct Phishing Email From cocinternal.com Sender (via m365)

This rule detects inbound email from the cocinternal.com sender infrastructure used in the multi-stage code of conduct phishing campaign that lures recipients into an adversary-in-the-middle page capturing Microsoft sign-in tokens. Adversaries theme these messages around a corporate code of conduct to prompt urgent sign-in, so mail originating from this sender domain warrants review as the entry point to token compromise.

Malicious Exchange Inbox Rule Hiding Direct Deposit and Bank Emails via Payroll Pirate Compromise (via m365)

This rule detects Exchange Online inbox rules that move or delete messages mentioning direct deposit, bank, or payroll, an email-hiding technique used by Storm-2755 to conceal payroll change alerts from compromised Canadian employees. Adversaries suppress these notifications so their rerouting of salary payments goes unnoticed, making inbox rules keyed on payment keywords a high-confidence sign of payroll fraud.

Suspicious Bulk Mail and File Collection via MSGraph Application Access (via m365)

This rule detects application-context access to mailbox items through the Microsoft Graph API by a non-owner identity, the exfiltration behavior Silk Typhoon uses after adding credentials to compromised service principals to steal email and files from targeted tenants. Adversaries prefer app-based MSGraph access to harvest data at scale while evading per-user controls, so bulk MailItemsAccessed events under an application identity indicate cloud data theft.

Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit

This rule detects creation of anonymous or secure sharing links in SharePoint and OneDrive, an abuse pattern in which attackers host phishing lures on trusted file services and share them broadly to steal identities. Adversary-in-the-middle campaigns use restricted-access links to evade automated scanning while harvesting session cookies from victims.

Suspicious ApplicationImpersonation Role Assigned to Mailbox Principal (via m365)

This rule detects assignment of the Exchange ApplicationImpersonation management role. Midnight Blizzard used impersonation rights combined with malicious OAuth applications to read targeted mailboxes via Exchange Web Services.

Suspicious OAuth Application Consent Granted High Privilege Mail Scopes (via m365)

This rule detects OAuth application consent operations granting mailbox read write and send permissions. Financially motivated actors registered and consented malicious OAuth applications with mail.readwrite and mail.send scopes to automate mail-based fraud and exfiltration.

Suspicious Legacy Authentication via BAV2ROPC User Agent (via m365)

This rule detects Entra ID sign-ins using the BAV2ROPC user agent that indicates legacy resource owner password credential authentication over IMAP or SMTP. Threat actors abusing OAuth applications used this legacy flow to bypass modern authentication controls for mailbox access.

Malicious Storm-2561 DLL Sideloading via Fake Pulse Secure Directory (via image_load)

This rule detects DLL sideloading where dwmapi.dll or inspector.dll is loaded from a fake Pulse Secure directory under Common Files, the execution technique used by Storm-2561 to run credential-stealing code under a trusted-looking VPN process. The inspector.dll payload then reads the connectionstore.dat credential store, so loading these modules from the planted directory reveals active theft of VPN and stored credentials.

Suspicious rastls DLL Sideloading by kavp via Image Load

This rule detects the Symantec kavp.exe binary loading rastls.dll from outside a legitimate Symantec installation path, the DLL side-loading technique Secret Blizzard used to execute the Kazuar backdoor while abusing another group's tooling. A trusted security vendor binary loading its companion DLL from an unexpected location indicates a hijacked side-loading pair.

Suspicious SmallTiger Backdoor DLL Load via Image Load

This rule detects the load of SmallTiger.dll, the named backdoor DLL used by the North Korean actor Onyx Sleet to establish access on compromised hosts. The DLL is delivered and side-loaded during intrusions, so its presence in an image load event is a strong indicator of Onyx Sleet activity.

Suspicious DLL Search Order Hijack of clip.exe or wsmprovhost.exe (via image_load)

This rule detects the trusted binaries clip.exe or wsmprovhost.exe loading Version.dll or DSROLE.dll from a location outside the Windows system directories. North Korean actors abused DLL search-order hijacking against these binaries to execute their payload under a trusted process.

Malicious GigaWiper Ransomware File Extension .candy

This rule detects creation of files with the .candy extension, the marker appended to encrypted files by the GigaWiper destructive backdoor. A burst of files gaining this extension indicates active data destruction and encryption in progress across the host.