deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Access Tool - Ammy Admin Agent Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2024-08-05
Log source: windows/process_creation

Description:
Detects the execution of the Ammy Admin RMM agent for remote management.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": "AMMYY\\aa_nts.dll\",run"
  },
  "condition": "selection"
}

References:
  - https://www.ammyy.com/en/admin_features.html
Sigma Detection Rule: Process Execution From WebDAV Share
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-13
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.


Detection logic:
{
  "selection": {
    "Image|startswith": "\\\\\\\\",
    "Image|contains": "\\DavWWWRoot\\"
  },
  "condition": "selection"
}

References:
  - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
Sigma Detection Rule: DLL Call by Ordinal Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-10-22
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects calls of DLLs exports by ordinal numbers via rundll32.dll.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ",#",
      ", #",
      ".dll #",
      ".ocx #"
    ]
  },
  "filter_optional_edge": {
    "CommandLine|contains|all": [
      "EDGEHTML.dll",
      "#141"
    ]
  },
  "filter_optional_vsbuild_dll": {
    "ParentImage|contains": [
      "\\Msbuild\\Current\\Bin\\",
      "\\VC\\Tools\\MSVC\\",
      "\\Tracker.exe"
    ],
    "CommandLine|contains": [
      "\\FileTracker32.dll,#1",
      "\\FileTracker32.dll\",#1",
      "\\FileTracker64.dll,#1",
      "\\FileTracker64.dll\",#1"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
  - https://github.com/Neo23x0/DLLRunner
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]43236608
  - https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/
Sigma Detection Rule: ClickOnce Deployment Execution - Dfsvc.EXE Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-12
Log source: windows/process_creation

Description:
Detects child processes of "dfsvc" which indicates a ClickOnce deployment execution.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\dfsvc.exe",
    "Image|endswith": "\\AppData\\Local\\Apps\\2.0\\"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Sigma Detection Rule: System Information Discovery Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-19
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,
and GPU driver products/versions.


Detection logic:
{
  "selection_wmic": [
    {
      "Description": "WMI Commandline Utility"
    },
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_get": {
    "CommandLine|contains": "get"
  },
  "selection_classes": {
    "CommandLine|contains": [
      "baseboard",
      "bios",
      "cpu",
      "diskdrive",
      "logicaldisk",
      "memphysical",
      "os",
      "path",
      "startup",
      "win32_videocontroller"
    ]
  },
  "selection_attributes": {
    "CommandLine|contains": [
      "caption",
      "command",
      "driverversion",
      "maxcapacity",
      "name",
      "osarchitecture",
      "product",
      "size",
      "smbiosbiosversion",
      "version",
      "videomodedescription"
    ]
  },
  "filter_optional_vmtools": {
    "ParentCommandLine|contains": "\\VMware\\VMware Tools\\serviceDiscovery\\scripts\\"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
  - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
  - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
  - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/
  - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/
Sigma Detection Rule: Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-17
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location.
When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.


Detection logic:
{
  "selection_image": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_cmdline": {
    "CommandLine|contains": [
      " /s ",
      " /e "
    ]
  },
  "filter_main_paths": [
    {
      "CommandLine|contains": [
        ":\\Program Files (x86)",
        ":\\Program Files\\",
        ":\\Windows\\System32\\",
        ":\\Windows\\SysWOW64\\"
      ]
    },
    {
      "CurrentDirectory|contains": [
        ":\\Program Files (x86)",
        ":\\Program Files\\",
        ":\\Windows\\System32\\",
        ":\\Windows\\SysWOW64\\"
      ]
    }
  ],
  "filter_main_other_flags": {
    "CommandLine|contains": [
      " /i:",
      "/U "
    ]
  },
  "filter_main_rpcproxy": {
    "ParentCommandLine|endswith": ":\\Windows\\System32\\RpcProxy\\RpcProxy.dll",
    "CommandLine": "regsvr32 /s rpcproxy.dll"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/288fc4f954f98d724e6fab32a89477943df5c0e9662cb199a19b90ae0c63aebe/detection
  - https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver
  - https://ss64.com/nt/regsvr32.html
Sigma Detection Rule: Potential BOINC Software Execution (UC-Berkeley Signature)
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Matt Anderson (Huntress)
Date: 2024-07-23
ATT&CK techniques: T1553
Log source: windows/process_creation

Description:
Detects the use of software that is related to the University of California, Berkeley via metadata information.
This indicates it may be related to BOINC software and can be used maliciously if unauthorized.


Detection logic:
{
  "selection": {
    "Description": "University of California, Berkeley"
  },
  "condition": "selection"
}

References:
  - https://boinc.berkeley.edu/
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
Sigma Detection Rule: Dynamic .NET Compilation Via Csc.EXE - Hunting
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-02
ATT&CK techniques: T1027.004
Log source: windows/process_creation

Description:
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\csc.exe",
    "CommandLine|contains": "/noconfig /fullpaths @"
  },
  "condition": "selection"
}

References:
  - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]82448897
Sigma Detection Rule: Headless Process Launched Via Conhost.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-23
ATT&CK techniques: T1059.001, T1059.003
Log source: windows/process_creation

Description:
Detects the launch of a child process via "conhost.exe" with the "--headless" flag.
The "--headless" flag hides the windows from the user upon execution.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\conhost.exe",
    "ParentCommandLine|contains": "--headless"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
Sigma Detection Rule: Uncommon GrantedAccess Flags On LSASS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-13
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "GrantedAccess|endswith": "10"
  },
  "filter1": {
    "SourceImage": [
      "C:\\Program Files\\Common Files\\McAfee\\MMSSHost\\MMSSHOST.exe",
      "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe",
      "C:\\Program Files\\Windows Defender\\MsMpEng.exe",
      "C:\\PROGRAMDATA\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe",
      "C:\\Windows\\System32\\lsass.exe",
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\WINDOWS\\System32\\perfmon.exe",
      "C:\\WINDOWS\\system32\\taskhostw.exe",
      "C:\\WINDOWS\\system32\\taskmgr.exe",
      "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe",
      "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe"
    ]
  },
  "filter2": {
    "SourceImage|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "SourceImage|endswith": "\\MsMpEng.exe"
  },
  "filter3": {
    "SourceImage|startswith": "C:\\Program Files\\WindowsApps\\",
    "SourceImage|endswith": "\\GamingServices.exe"
  },
  "filter4": {
    "SourceImage|endswith": [
      "\\PROCEXP64.EXE",
      "\\PROCEXP.EXE"
    ]
  },
  "filter5": {
    "SourceImage|startswith": "C:\\ProgramData\\VMware\\VMware Tools\\",
    "SourceImage|endswith": "\\vmtoolsd.exe"
  },
  "filter6": {
    "SourceImage|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ],
    "SourceImage|contains": "Antivirus"
  },
  "filter_nextron": {

References:
  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/[PII_REDACTED]3920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/[PII_REDACTED]3146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
Sigma Detection Rule: Potential Credential Dumping Attempt Via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetImage|endswith": "\\lsass.exe"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: LSASS Access From Program In Potentially Suspicious Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-27
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "GrantedAccess|endswith": [
      "10",
      "30",
      "50",
      "70",
      "90",
      "B0",
      "D0",
      "F0",
      "18",
      "38",
      "58",
      "78",
      "98",
      "B8",
      "D8",
      "F8",
      "1A",
      "3A",
      "5A",
      "7A",
      "9A",
      "BA",
      "DA",
      "FA",
      "0x14C2",
      "FF"
    ],
    "SourceImage|contains": [
      "\\Temp\\",
      "\\Users\\Public\\",
      "\\PerfLogs\\",
      "\\AppData\\",
      "\\Temporary"
    ]
  },
  "filter_optional_generic_appdata": {
    "SourceImage|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\"
    ],
    "SourceImage|endswith": [
      "\\Microsoft VS Code\\Code.exe",
      "\\software_reporter_tool.exe",
      "\\DropboxUpdate.exe",
      "\\MBAMInstallerService.exe",
      "\\WebexMTA.exe",
      "\\Meetings\\WebexMTAV2.exe",
      "\\WebEx\\WebexHost.exe",
      "\\JetBrains\\Toolbox\\bin\\jetbrains-toolbox.exe"
    ],
    "GrantedAccess": "0x410"
  },
  "filter_optional_dropbox_1": {
    "SourceImage|contains": ":\\Windows\\Temp\\",
    "SourceImage|endswith": ".tmp\\DropboxUpdate.exe",
    "GrantedAccess": [
      "0x410",
      "0x1410"
    ]
  },
  "filter_optional_dropbox_2": {
    "SourceImage|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Temp\\"
    ],
    "SourceImage|endswith": ".tmp\\DropboxUpdate.exe",
    "GrantedAccess": "0x1410"
  },
  "filter_optional_dropbox_

References:
  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/[PII_REDACTED]3920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/[PII_REDACTED]3146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
Sigma Detection Rule: Potential Shellcode Injection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bhabesh Raj
Date: 2022-03-11
ATT&CK techniques: T1055
Log source: windows/process_access

Description:
Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.

Detection logic:
{
  "selection": {
    "GrantedAccess": [
      "0x147a",
      "0x1f3fff"
    ],
    "CallTrace|contains": "UNKNOWN"
  },
  "filter_main_wmiprvse": {
    "SourceImage": "C:\\Windows\\System32\\Wbem\\Wmiprvse.exe",
    "TargetImage": "C:\\Windows\\system32\\lsass.exe"
  },
  "filter_optional_dell_folders": {
    "SourceImage|startswith": [
      "C:\\Program Files\\Dell\\",
      "C:\\Program Files (x86)\\Dell\\"
    ],
    "TargetImage|startswith": [
      "C:\\Program Files\\Dell\\",
      "C:\\Program Files (x86)\\Dell\\"
    ]
  },
  "filter_optional_dell_specifc": {
    "SourceImage": "C:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe",
    "TargetImage": "C:\\Windows\\Explorer.EXE"
  },
  "filter_optional_visual_studio": {
    "SourceImage|startswith": "C:\\Program Files\\Microsoft Visual Studio\\",
    "TargetImage|startswith": "C:\\Program Files\\Microsoft Visual Studio\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/EmpireProject/PSInject
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-17

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-20

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-28

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-06

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Luc Génaux
Date: 2026-03-18

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-12

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-02-04

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: SigmaHQ Team
Date: 2025-10-24

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: SigmaHQ Team
Date: 2025-10-31

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-26

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-25

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-23

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-05

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-11

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-08

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-29

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-10

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-07

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-03

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-19

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Daniel Koifman (KoifSec)
Date: 2025-12-02

Description:
Includes two process events that will match against the linked SIGMA rule for both conditions
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-08

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-04

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-11

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-23

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-01-19

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-03

Description:
N/A
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Luc Génaux
Date: 2026-03-20

Description:
The user double clicked on a file named Annexe.jpeg, whose actual filename was Ann[U+202E]gepj.exe (using an RTLO character).
Sigma Detection Rule: 
Repository: SigmaHQ/sigma
Author: Ayush Anand (Securityinbits)
Date: 2026-02-28

Description:
N/A
Sigma Detection Rule: Activity from Suspicious IP Addresses
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
ATT&CK techniques: T1573
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.


Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Activity from suspicious IP addresses",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Activity from Anonymous IP Addresses
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
ATT&CK techniques: T1573
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Activity from anonymous IP addresses",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Activity Performed by Terminated User
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-23
Log source: m365/

Description:
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.


Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "Activity performed by terminated user",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Sigma Detection Rule: Microsoft 365 - User Restricted from Sending Email
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: austinsonger
Date: 2021-08-19
ATT&CK techniques: T1199
Log source: m365/

Description:
Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.

Detection logic:
{
  "selection": {
    "eventSource": "SecurityComplianceCenter",
    "eventName": "User restricted from sending email",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference