Every published rule

Azure Entra ID Sign-ins with User-Agent Containing "axios"

Flags Azure Entra ID sign-ins with a user agent containing "axios", indicating potential automated sign-in activity.

Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.

Linux setcap sets cap_setuid on a binary via setcap utility

Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.

Web Browser Opens .HTM/.HTML from Downloads Folder on Windows

Flags browser processes opening .htm files from a user’s Downloads folder on Windows, a pattern consistent with HTML attachment activity.

Linux File Creation with Unusually Long Filenames (100+ Characters)

Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.

Windows: Detect Advanced Installer PSF AI_STUBS Executables with OriginalFileName popupwrapper.exe

Flags Windows execution of Advanced Installer PSF AI_STUBS stubs where OriginalFileName equals popupwrapper.exe.

Windows: Successful MSIX/AppX Package Installation via AppX Deployment Server (Event ID 854)

Flags successful MSIX/AppX package installations on Windows using EventID 854 from the AppXDeployment-Server operational log.

GitHub Audit Events: Repository Archived/Unarchived Status Change

Alerts on GitHub audit events indicating a repository was archived or unarchived.

GitHub Pages repository site changed to public (repo.pages_public audit event)

Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.

Windows Process Creation: Executable Launches Identical Self Instance (Sacrificial Process)

Alerts on Windows process creation where a targeted parent context suggests an executable spawns an identical instance, potentially as a sacrificial process.

Linux sudo --chroot Command Execution

Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.

Windows Process Loaded BitsProxy.dll via Uncommon Image

Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.

Linux mknod Syscall Used to Create Special Files

Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

Windows: Deno writes files from remote HTTPS content into AppData

Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.

Windows File Access to Browser Credential Storage by Non-Browser Processes

Flags non-browser processes reading common browser credential storage files on Windows, indicating potential credential theft.