Sigma detection rules, expert-reviewed

Windows Kerberos KDC: Certificate used without strong user mapping

Alerts on Windows KDC certificate validation events lacking strong certificate-to-user mapping (Event 39/41).

Windows Process Creation: Visual Studio Code Tunnel Execution with Renamed Binary

Flags Windows process executions that match renamed VS Code tunnel invocation patterns and related internal service startup.

Windows Service Registry Key ReadControl Access (Event ID 4663)

Flags READ_CONTROL access requests to service registry keys (\SYSTEM\ControlSet\Services\) via Windows Security Event 4663.

AWS CloudTrail: AWS Identity Center Identity Provider Configuration Changes

Detects CloudTrail identity center events that associate or change the external identity provider configuration.

Windows Registry Scheduled Task Cache Key Creation Detection

Flags registry event activity under Scheduled TaskCache indicating scheduled task creation or updates on Windows.

Windows Scheduled Task File Creation Activity (File Event)

Flags file creation under Windows scheduled task directories that may indicate new scheduled task persistence.

Windows: AddInUtil.exe LoLBin Executed from Non-Standard Directory

Alerts when AddInUtil.exe (AddInUtil.exe) runs from an uncommon directory path on Windows.

Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs where AddInRoot/PipelineRoot command-line paths deviate from common VSTA locations.

Windows: Uncommon Child Processes Spawned by Addinutil.exe

Alerts when Addinutil.exe launches an uncommon child process, indicating potential proxy execution abuse.

Windows AddInUtil.exe Executed with Suspicious AddInRoot or PipelineRoot Parameters

Alerts on AddInUtil.exe runs using uncommon AddInRoot/PipelineRoot values targeting Temp, Desktop, Downloads, or public user paths.

Windows network connections initiated by AddinUtil.exe

Alerts on network connections initiated by Addinutil.exe, which is uncommon for this utility on Windows.

Microsoft 365 Audit: New Federated Domain Added

Alerts on Microsoft 365 audit events indicating a new federated domain was added.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Windows: Diskshadow.exe Script Mode Execution from Suspicious File Paths

Alerts when diskshadow.exe runs with /s and a script path found in Temp/AppData/ProgramData/Users\Public-style directories.

Windows Diskshadow Script Mode Executes Script File with Uncommon .txt Extension

Alerts when diskshadow.exe runs with -s script mode and the script path/command includes an uncommon extension like .txt.