Sigma detection rules, expert-reviewed

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.

Microsoft 365 Audit Logs: Inbox Rule Creation or Update with Email Hiding Actions

Flags M365 audit events where inbox rules are created/updated with parameters that can delete, mark, move, or keyword-match messages.

OpenCanary RDP New Connection Attempt on Application Logtype 14001

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

OpenCanary Application Logs: Detect SYN Port Scan Targets on a Hosted Node

Flags OpenCanary events indicating the host was probed with a TCP SYN port scan.

OpenCanary application logs: detect NMAP XMAS scans targeting an OpenCanary node

Detects OpenCanary log events showing an Nmap Xmas scan targeting the monitored node.

OpenCanary: Detect NMAP OS Scan Targets via Application Logtype 5002

Alerts when OpenCanary records an NMAP OS scan event (logtype 5002), indicating host fingerprinting activity.

OpenCanary - Nmap NULL Scan Targeting Detected

Detects OpenCanary logtype 5003 events consistent with NMAP NULL scan targeting.

OpenCanary Application Logs: Nmap FIN Scan Targeting (Logtype 5005)

Detects Nmap FIN scan targeting against an OpenCanary node using application logs with logtype 5005.

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

Windows: Kernel Driver Utility (KDU) and hamakaze.exe Execution

Alerts on KDU/hamakaze.exe launches with command-line parameters associated with kernel driver loading.

Windows devcon.exe Command Line Disabling VMware VMCI Device

Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.

Windows Registry Set: Disable Windows Credential Guard by Zeroing EnableVirtualizationBasedSecurity

Alerts on registry value changes that zero Credential Guard/LSA configuration flags to disable virtualization-based secret protection.

Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags

Flags deletion of Credential Guard/LSA-related registry values that may weaken virtualization-based secret protection.

Windows Credential Guard Registry Key Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/Reg.exe commands that add/modify/delete DeviceGuard/LSA registry values tied to Credential Guard.

Windows AMSI Disabled by Registry Value Modification (AmsiEnable)

Alerts when Windows Script Settings AmsiEnable is set to 0x00000000 to disable AMSI.