Sigma detection rules, expert-reviewed

Windows Scheduled Task File Creation Activity (File Event)

Flags file creation under Windows scheduled task directories that may indicate new scheduled task persistence.

Windows: AddInUtil.exe LoLBin Executed from Non-Standard Directory

Alerts when AddInUtil.exe (AddInUtil.exe) runs from an uncommon directory path on Windows.

Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs where AddInRoot/PipelineRoot command-line paths deviate from common VSTA locations.

Windows: Uncommon Child Processes Spawned by Addinutil.exe

Alerts when Addinutil.exe launches an uncommon child process, indicating potential proxy execution abuse.

Windows AddInUtil.exe Executed with Suspicious AddInRoot or PipelineRoot Parameters

Alerts on AddInUtil.exe runs using uncommon AddInRoot/PipelineRoot values targeting Temp, Desktop, Downloads, or public user paths.

Windows network connections initiated by AddinUtil.exe

Alerts on network connections initiated by Addinutil.exe, which is uncommon for this utility on Windows.

Microsoft 365 Audit: New Federated Domain Added

Alerts on Microsoft 365 audit events indicating a new federated domain was added.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Windows: Diskshadow.exe Script Mode Execution from Suspicious File Paths

Alerts when diskshadow.exe runs with /s and a script path found in Temp/AppData/ProgramData/Users\Public-style directories.

Windows Diskshadow Script Mode Executes Script File with Uncommon .txt Extension

Alerts when diskshadow.exe runs with -s script mode and the script path/command includes an uncommon extension like .txt.

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Windows Diskshadow.exe Child Process Execution

Alerts when Diskshadow.exe is the parent process of a newly created process on Windows.

Windows File Access to .reg and .hive Backups by Uncommon Applications

Alerts on access to .hive/.reg files from less-common application paths on Windows.

Azure Entra PIM Alerts: Too Many Global Administrators Assigned to Tenant

Alerts when Azure PIM reports an overabundance of Global Administrator role assignments in a tenant.

Azure AD PIM Redundant Assignment Alert When Privileged Role Not Used

Alerts on Azure PIM redundant privileged role assignments where the assigned role appears unused.