Sigma detection rules, expert-reviewed

Microsoft 365 Threat Management: PST Export via New-ComplianceSearchAction -Export

Flags M365 SecurityComplianceCenter activity that includes New-ComplianceSearchAction with -Export for PST content.

Windows file activity matching CrackMapExec/Impacket-secretsdump credential dumping temp output patterns

Alerts on Windows temp file creations consistent with CrackMapExec or Impacket-secretsdump credential dumping activity.

Windows Driver Load: Process Hacker (processhacker.sys) Presence

Flags Windows driver loads of Process Hacker’s processhacker.sys using path and known imphash indicators.

Windows Process Creation: Suspicious RunAs-Like Command-Line Flag Combination

Flags Windows processes with both target-user and target-command flags in the same command line.

PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

Windows: Detect sftp.exe used as a LOLBIN via -D option

Alerts on Windows executions of sftp.exe using the -D flag with a path argument.

Windows Code Integrity blocked image/driver loads due to signature level or policy violations

Alerts on Windows Code Integrity Event ID 3077 when an image/driver load is blocked for signing-level or policy violations.

Windows Process Creation: Sysmon.exe as Parent of Spawned Process

Alerts when Sysmon.exe/Sysmon64.exe is the parent of a new process, a potentially suspicious execution chain on Windows.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).

Windows System: Kerberos KDC RC4-HMAC downgrade exploit attempts (CVE-2022-37966)

Identifies Windows Kerberos KDC error events tied to RC4-HMAC downgrade/auth negotiation exploitation behavior (CVE-2022-37966).

Windows AppCmd Password Listing Activity via IIS Service Credentials Exposure

Flags appcmd.exe executions that include password-related listing parameters for IIS service account credentials.

Windows File Creation: Suspicious LNK Double-Extension Targeted by Document/Image Prefixes

Alerts on Windows-created filenames that end in .lnk while containing hidden-looking double extensions (e.g., .doc. .pdf.)

Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Identifies Windows successful logons consistent with potential access token impersonation using Advapi and Negotiate.

Windows process creation: suspicious ping wait followed by del file deletion

Flags cmd/powershell command lines that use ping -n with Nul redirection followed by Del /f /q to delete a file.

Windows Executable Initiating Connections to ngrok Tunnel Domains

Flags Windows network connections to ngrok tunnel subdomains that may indicate tunneling for C2 or staging.