Sigma detection rules, expert-reviewed

Windows: New Outlook VBAProject OTM Macro File Created

Flags Windows file creation of Outlook VBAProject.OTM when initiated by outlook.exe.

Windows Exchange Management: Set-OabVirtualDirectory ExternalUrl to script content

Detects Exchange Management changes to OAB ExternalUrl containing script indicators and Page_Load.

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Alerts on schtasks.exe commands that create one-time scheduled tasks referencing a Temp directory.

Windows: Suspicious Service Binary Executed from Public/System Directories

Alerts on service-hosted processes executing from user/public or system-writable directories on Windows.

Windows Process Creation: Exchange Server Artifact Discovery and File Staging Patterns

Alerts on Exchange-focused suspicious Windows command-line activity involving dumping, temp file creation, and compression utilities.

Windows Registry: VBScript/HTMLApplication Payload Stored Under Run Keys

Flags registry persistence where script payload indicators like vbscript: and RunHTMLApplication appear in set registry values.

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.

Windows rundll32 Executing Inline VBScript via RegRead

Detects rundll32.exe command lines containing inline VBScript execution with RegRead and window.close.

Windows Process Command Line: Suspicious Inline VBScript with UN2452-Like Keywords

Alerts on Windows command lines containing inline VBScript keywords and registry access indicators matching the UNC2452 UN2452 pattern.

Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin

Flags PowerShell executions that Add-PSSnapin Exchange snap-ins, consistent with Exchange mailbox/config data collection.

Windows PowerShell TcpClient reverse-shell connection attempt via Net.Sockets

Alerts on PowerShell processes launching with .NET TcpClient stream/write patterns consistent with reverse TCP connectivity.

Microsoft Exchange exploitation attempt via suspicious POST requests in web server logs

Flags POST traffic to Exchange OWA/ECP-related URLs with specific client and user-agent indicators consistent with exploitation attempts.

Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation

Alerts on Exchange Unified Messaging (UMWorkerProcess.exe) creating unusual files, excluding common benign names consistent with CVE-2021-26858 activity.

Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.