Sigma detection rules, expert-reviewed

Microsoft 365 eDiscovery PST Export or Search Started Success Alert

Alerts on successful eDiscovery search/export activity that produces PST files in Microsoft 365.

Windows Process Command Line Network Recon via nslookup LDAP SRV Query

Identifies Windows command lines running nslookup with an LDAP SRV domain controller discovery query string.

Windows Process Creation: Suspicious systeminfo.exe Execution

Alerts on execution of systeminfo.exe (or sysinfo.exe) via Windows process creation logs for system discovery.

Windows: Suspicious Process Execution of hostname.exe

Flags execution of hostname.exe from process creation events on Windows for discovery activity.

SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration

Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.

SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)

Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.

RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)

Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.

PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)

Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.

PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

PowerShell Module: Get-SmbShare Used for SMB Share Discovery

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.