Sigma detection rules, expert-reviewed

Azure AD LeakedCredentials Risk Event Indicates User Credential Exposure

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

Azure risk event: Suspicious inbox manipulation rules that delete or move messages or folders

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

Azure Risk Event: Suspicious Inbox Forwarding

Alerts on Azure Identity Protection risk events indicating inbox forwarding to an external address.

Azure AD User Login Risk: Impossible Travel from Distant Locations

Flags Azure Entra risk events tagged as impossibleTravel indicating implausible geographic sign-in travel within a short time.

Azure Entra ID Identity Protection Unlikely Travel Risk Events

Alerts on unlikelyTravel risk events tied to geographically distant sign-ins and potential deviation from user travel history.

Azure RiskDetection flags riskyIPAddress from anonymous proxy IP addresses

Alerts when Azure reports user activity linked to a risky anonymous proxy IP address.

Azure Entra ID anomalous user activity risk event

Alerts on Azure AD risk events indicating anomalous user activity via riskEventType=anomalousUserActivity.

Suspicious Child Process Spawned by WinRAR.exe on Windows

Alerts when WinRAR.exe launches command, scripting, or proxy execution binaries on Windows.

Qakbot Uninstaller Execution via QbotUninstall.exe (Windows Process Creation)

Alerts on execution of the QbotUninstall.exe uninstaller when it matches known Qakbot uninstaller hashes.

Suspicious rundll32 Single-Digit DLL Execution with DllRegisterServer on Windows

Flags rundll32.exe running 1.dll with DllRegisterServer, a pattern seen in suspicious DLL execution.

Windows: WinRAR.exe Application Error Crash on Versions Below 6.23

Flags WinRAR.exe crash events on Windows when the installed version is below 6.23.x.

Windows: Detect WinRAR Creating .rev Files Associated with CVE-2023-40477

Alert on .rev file creation tied to WinRAR/Explorer on Windows as an indicator of potential CVE-2023-40477 exploitation.

Suspicious WinRAR Child Process Execution Attempt on Windows (CVE-2023-38331)

Alerts on WinRAR spawning command/scripting child processes tied to Temp\Rar$ activity consistent with CVE-2023-38331 exploitation attempts.

Windows: WinRAR double-extension file creation with space in Temp Rar$ path

Alerts on WinRAR-created Temp Rar$ files with double extensions separated by a space on Windows.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.