Sigma detection rules, expert-reviewed

Windows Cmd.exe: SET /p file append/override pattern via set /p=

Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.

Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values

Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.

Windows: Uncommon Process Access to Chromium User Data Cookies and History

Alerts on uncommon executables reading Chromium cookies/history/web data on Windows, excluding common system and installer paths.

Windows File Access Attempt to Panther\unattend.xml During Unattended Install

Alerts on attempts to access Panther\unattend.xml on Windows, a potential source of embedded credentials.

Windows Process Execution of BitLockerToGo.EXE

Alerts on Windows execution of BitLockerToGo.exe, a rarely used BitLocker To Go component for portable drive encryption.

AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules

Identifies when EC2 network ACL entries are created in AWS via CloudTrail.

Windows: Microsoft Word Loads WLL Add-In Files

Flags Microsoft Word loading a .wll add-in module on Windows using image load telemetry.

Windows Process Access to Uncommon Target Images Using PROCESS_ALL_ACCESS

Alerts on Windows events granting PROCESS_ALL_ACCESS to processes with uncommon target image filenames.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

Unusual Access to Windows Outlook Unistore Mail Data by Non-Standard Processes

Alerts when unusual processes access Outlook Unistore (data and UnistoreDB store.vol) file locations on Windows.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.

Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts

Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.

Kubernetes Service Account Created via Audit Log

Alerts on Kubernetes audit events showing new ServiceAccounts created.

Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)

Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.

Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt

Alerts on Kubernetes selfsubjectrulesreviews API calls that enumerate the caller’s RBAC permissions.