Sigma detection rules, expert-reviewed

Windows MSSQL Failed Logon (EventID 18456) From External Client IP

Alerts on MSSQL failed login attempts (Event 18456) from client IPs outside typical local/private ranges.

Windows MSSQL Failed Logon (Event ID 18456) Detection

Alerts on MSSQL-related failed login attempts (Event ID 18456) captured in Windows application logs.

O365 Mail Forwarding and Redirecting Rule Changes

Identifies O365 mailbox/inbox rule changes that configure forwarding or redirects in audit logs.

Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe

Alerts on FoxitPDFReader.exe creating .hta files in the Startup Programs folder, which can indicate persistence.

Windows ScreenConnect RMM System Command Execution via cmd.exe

Flags cmd.exe launched by ScreenConnect.ClientService.exe with a TEMP\ScreenConnect command-line path.

Windows: ScreenConnect Temporary File Creation in ConnectWiseControl Temp

Flags file writes to ScreenConnect’s ConnectWiseControl\Temp staging directory from ScreenConnect.WindowsClient.exe.

Windows Application: ScreenConnect RMM File Transfer Activity (Event 201)

Flags ScreenConnect RMM file transfer events on Windows based on provider name, Event ID 201, and transfer action text.

Windows ScreenConnect Remote Command Execution (EventID 200)

Detects ScreenConnect command execution on Windows by matching EventID 200 with an 'Executed command of length' message.

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Flags Windows CLI commands referencing the NTFS ::$index_allocation stream for potential hidden directory activity.

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Alerts on Windows file events creating hidden NTFS content using the '::$index_allocation' alternate stream.

Windows Kerberos KDC: Certificate used without strong user mapping

Alerts on Windows KDC certificate validation events lacking strong certificate-to-user mapping (Event 39/41).

Windows Process Creation: Visual Studio Code Tunnel Execution with Renamed Binary

Flags Windows process executions that match renamed VS Code tunnel invocation patterns and related internal service startup.

Windows Service Registry Key ReadControl Access (Event ID 4663)

Flags READ_CONTROL access requests to service registry keys (\SYSTEM\ControlSet\Services\) via Windows Security Event 4663.

AWS CloudTrail: AWS Identity Center Identity Provider Configuration Changes

Detects CloudTrail identity center events that associate or change the external identity provider configuration.

Windows Registry Scheduled Task Cache Key Creation Detection

Flags registry event activity under Scheduled TaskCache indicating scheduled task creation or updates on Windows.