Query: Sigma YAML for windows / security
Matching passage: Sigma rule: This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health. Logsource: windows / security. Rule: title: Azure AD Health Monitoring Agent Registry Keys Access id: ff151c33-45fa-475d-af4f-c2f93571f4fe status: test description: 'This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent. ' references: - https://o365blog.com/post/hybridhealthagent/ - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2022-10-09 tags: - attack.discovery - attack.t1012 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectType: Key ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent filter: ProcessName|contains: - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe - Microsoft.Identity.Health.Adfs.InsightsService.exe - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe - Microsoft.Identity.Health.Adfs.PshSurrogate.exe - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may. Logsource: windows / process_creation. Rule: title: Script Interpreter Execution From Suspicious Folder id: 1228c958-e64e-4e71-92ad-7d429f4138ba status: test description: 'Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts. ' references: - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - https://learn.microsoft.com/en-us/windows/win32/shell/csidl author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-08 modified: 2026-02-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_proc_image: Image|endswith: - \cscript.exe - \mshta.exe - \wscript.exe selection_proc_flags: CommandLine|contains: - ' -ep bypass ' - ' -ExecutionPolicy bypass ' - ' -w hidden ' - '/e:javascript ' - '/e:Jscript ' - '/e:vbscript ' selection_proc_original: OriginalFileName: - cscript.exe - mshta.exe - wscript.exe selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \%Public% - \AppData\Local\Temp - \AppData\Roaming\Temp - \Temporary Internet - \Windows\Temp - \Start Menu\Programs\Startup\ - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Documents\ - CommandLine|contains|all: - :\Users\ - \Music\ - CommandLine|contains|all: - :\Users\ - \Pictures\ - CommandLine|contains|all: - :\Users\ - \Videos\ filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environme