deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Sysmon Channel Reference Deletion
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-07-14
ATT&CK techniques: T1112
Log source: windows/

Description:
Potential threat actor tampering with Sysmon manifest and eventually disabling it

Detection logic:
{
  "selection1": {
    "EventID": 4657,
    "ObjectName|contains": [
      "WINEVT\\Publishers\\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "WINEVT\\Channels\\Microsoft-Windows-Sysmon/Operational"
    ],
    "ObjectValueName": "Enabled",
    "NewValue": 0
  },
  "selection2": {
    "EventID": 4663,
    "ObjectName|contains": [
      "WINEVT\\Publishers\\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "WINEVT\\Channels\\Microsoft-Windows-Sysmon/Operational"
    ],
    "AccessMask": "0x10000"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/Flangvik/status/[PII_REDACTED]84473861
  - https://twitter.com/SecurityJosh/status/[PII_REDACTED]70276866
  - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html
  - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8
Sigma Detection Rule: Invoke-Obfuscation CLIP+ Launcher - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of Clip.exe to execute PowerShell

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "cmd",
      "&&",
      "clipboard]::"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-20
ATT&CK techniques: T1557.003
Log source: windows/

Description:
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.


Detection logic:
{
  "selection_directory_service_changes": {
    "EventID": [
      5136,
      5137
    ],
    "ObjectClass": "dnsNode",
    "ObjectDN|contains|all": [
      "UWhRCA",
      "BAAAA",
      "CN=MicrosoftDNS"
    ]
  },
  "selection_directory_service_access": {
    "EventID": 4662,
    "AdditionalInfo|contains|all": [
      "UWhRCA",
      "BAAAA",
      "CN=MicrosoftDNS"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
Sigma Detection Rule: Suspicious Access to Sensitive File Extensions
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1039
Log source: windows/

Description:
Detects known sensitive file extensions accessed on a network share

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "RelativeTargetName|endswith": [
      ".bak",
      ".dmp",
      ".edb",
      ".kirbi",
      ".msg",
      ".nsf",
      ".nst",
      ".oab",
      ".ost",
      ".pst",
      ".rdp"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Password Change on Directory Service Restore Mode (DSRM) Account
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Thomas Patzke
Date: 2017-02-19
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.


Detection logic:
{
  "selection": {
    "EventID": 4794
  },
  "condition": "selection"
}

References:
  - https://adsecurity.org/?p=1714
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794
Sigma Detection Rule: Potential AD User Enumeration From Non-Machine Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Maxime Thiebaut (@0xThiebaut)
Date: 2020-03-30
ATT&CK techniques: T1087.002
Log source: windows/

Description:
Detects read access to a domain user from a non-machine account

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "ObjectType|contains": "bf967aba-0de6-11d0-a285-00aa003049e2",
    "AccessMask|endswith": [
      "1?",
      "3?",
      "4?",
      "7?",
      "9?",
      "B?",
      "D?",
      "F?"
    ]
  },
  "filter_main_machine_accounts": {
    "SubjectUserName|endswith": "$"
  },
  "filter_main_msql": {
    "SubjectUserName|startswith": "MSOL_"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
  - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html
  - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
Sigma Detection Rule: Invoke-Obfuscation Via Use Rundll32 - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use Rundll32 in Scripts

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "&&",
      "rundll32",
      "shell32.dll",
      "shellexec_rundll"
    ],
    "ServiceFileName|contains": [
      "value",
      "invoke",
      "comspec",
      "iex"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Impacket PsExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2020-12-14
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects execution of Impacket's psexec.py.

Detection logic:
{
  "selection1": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName|contains": [
      "RemCom_stdin",
      "RemCom_stdout",
      "RemCom_stderr"
    ]
  },
  "condition": "selection1"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
Sigma Detection Rule: PetitPotam Suspicious Kerberos TGT Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mauricio Velazco, Michael Haag
Date: 2021-09-02
ATT&CK techniques: T1187
Log source: windows/

Description:
Detect suspicious Kerberos TGT requests.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.


Detection logic:
{
  "selection": {
    "EventID": 4768,
    "TargetUserName|endswith": "$",
    "CertThumbprint|contains": "*"
  },
  "filter_local": {
    "IpAddress": "::1"
  },
  "filter_thumbprint": {
    "CertThumbprint": ""
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/topotam/PetitPotam
  - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
  - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
Sigma Detection Rule: HackTool - EDRSilencer Execution - Filter Added
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thodoris Polyzos (@SmoothDeploy)
Date: 2024-01-29
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.


Detection logic:
{
  "selection": {
    "EventID": [
      5441,
      5447
    ],
    "FilterName|contains": "Custom Outbound Filter"
  },
  "condition": "selection"
}

References:
  - https://github.com/netero1010/EDRSilencer
Sigma Detection Rule: Register new Logon Process by Rubeus
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1558.003
Log source: windows/

Description:
Detects potential use of Rubeus via registered new trusted logon process

Detection logic:
{
  "selection": {
    "EventID": 4611,
    "LogonProcessName": "User32LogonProcesss"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
Sigma Detection Rule: DPAPI Domain Master Key Backup Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
ATT&CK techniques: T1003.004
Log source: windows/

Description:
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Detection logic:
{
  "selection": {
    "EventID": 4692
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Sigma Detection Rule: File Access Of Signal Desktop Sensitive Data
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Andreas Braathen (mnemonic.io)
Date: 2025-10-19
ATT&CK techniques: T1003
Log source: windows/

Description:
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.


Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectType": "File",
    "ObjectName|contains": "\\AppData\\Roaming\\Signal\\",
    "ObjectName|endswith": [
      "\\config.json",
      "\\db.sqlite"
    ]
  },
  "filter_main_signal": {
    "ProcessName|endswith": [
      "\\signal-portable.exe",
      "\\signal.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/
  - https://vmois.dev/query-signal-desktop-messages-sqlite/
Sigma Detection Rule: Suspicious Scheduled Task Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Detection logic:
{
  "selection_eid": {
    "EventID": 4698
  },
  "selection_paths": {
    "TaskContent|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Users\\Public\\",
      "\\WINDOWS\\Temp\\",
      "C:\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Temporary Internet",
      "C:\\ProgramData\\",
      "C:\\Perflogs\\"
    ]
  },
  "selection_commands": {
    "TaskContent|contains": [
      "regsvr32",
      "rundll32",
      "cmd.exe</Command>",
      "cmd</Command>",
      "<Arguments>/c ",
      "<Arguments>/k ",
      "<Arguments>/r ",
      "powershell",
      "pwsh",
      "mshta",
      "wscript",
      "cscript",
      "certutil",
      "bitsadmin",
      "bash.exe",
      "bash ",
      "scrcons",
      "wmic ",
      "wmic.exe",
      "forfiles",
      "scriptrunner",
      "hh.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
Sigma Detection Rule: AD Object WriteDAC Access
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-09-12
ATT&CK techniques: T1222.001
Log source: windows/

Description:
Detects WRITE_DAC access to a domain object

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "ObjectServer": "DS",
    "AccessMask": "0x40000",
    "ObjectType": [
      "19195a5b-6da0-11d0-afd3-00c04fd930c9",
      "domainDNS"
    ]
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
Sigma Detection Rule: Processes Accessing the Microphone and Webcam
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-07
ATT&CK techniques: T1123
Log source: windows/

Description:
Potential adversaries accessing the microphone and webcam in an endpoint.

Detection logic:
{
  "selection": {
    "EventID": [
      4657,
      4656,
      4663
    ],
    "ObjectName|contains": [
      "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone\\NonPackaged",
      "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam\\NonPackaged"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/duzvik/status/[PII_REDACTED]52813320
  - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
Sigma Detection Rule: ADCS Certificate Template Configuration Vulnerability
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Orlinum , BlueDefenZer
Date: 2021-11-17
Log source: windows/

Description:
Detects certificate creation with template allowing risk permission subject

Detection logic:
{
  "selection1": {
    "EventID": 4898,
    "TemplateContent|contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "selection2": {
    "EventID": 4899,
    "NewTemplateContent|contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "condition": "selection1 or selection2"
}

References:
  - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
Sigma Detection Rule: Windows Defender Exclusion List Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @BarryShooshooga
Date: 2019-10-26
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.


Detection logic:
{
  "selection": {
    "EventID": 4657,
    "ObjectName|contains": "\\Microsoft\\Windows Defender\\Exclusions\\"
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Sigma Detection Rule: A Member Was Added to a Security-Enabled Global Group
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Alexandr Yampolskyi, SOC Prime
Date: 2023-04-26
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects activity when a member is added to a security-enabled global group

Detection logic:
{
  "selection": {
    "EventID": [
      4728,
      632
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632
Sigma Detection Rule: Potential Access Token Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michaela Adams, Zach Mathis
Date: 2022-11-06
ATT&CK techniques: T1134.001
Log source: windows/

Description:
Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 9,
    "LogonProcessName": "Advapi",
    "AuthenticationPackageName": "Negotiate",
    "ImpersonationLevel": "%%1833"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation
  - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html
Sigma Detection Rule: Potential Privilege Escalation via Local Kerberos Relay over LDAP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Elastic, @SBousseaden
Date: 2022-04-27
ATT&CK techniques: T1548
Log source: windows/

Description:
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.


Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 3,
    "AuthenticationPackageName": "Kerberos",
    "IpAddress": "127.0.0.1",
    "TargetUserSid|startswith": "S-1-5-21-",
    "TargetUserSid|endswith": "-500"
  },
  "filter_main_ip_null": {
    "IpPort": "0"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]64056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g
  - https://github.com/elastic/detection-rules/blob/5fe[PII_REDACTED]a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38
Sigma Detection Rule: A Security-Enabled Global Group Was Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Alexandr Yampolskyi, SOC Prime
Date: 2023-04-26
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects activity when a security-enabled global group is deleted

Detection logic:
{
  "selection": {
    "EventID": [
      4730,
      634
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634
Sigma Detection Rule: Pass the Hash Activity 2
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)
Date: 2019-06-14
ATT&CK techniques: T1550.002
Log source: windows/

Description:
Detects the attack technique pass the hash which is used to move laterally inside the network

Detection logic:
{
  "selection_logon3": {
    "EventID": 4624,
    "SubjectUserSid": "S-1-0-0",
    "LogonType": 3,
    "LogonProcessName": "NtLmSsp",
    "KeyLength": 0
  },
  "selection_logon9": {
    "EventID": 4624,
    "LogonType": 9,
    "LogonProcessName": "seclogo"
  },
  "filter": {
    "TargetUserName": "ANONYMOUS LOGON"
  },
  "condition": "1 of selection_* and not filter"
}

References:
  - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
  - https://web.archive.org/web/[PII_REDACTED]1934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
  - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/
Sigma Detection Rule: DiagTrackEoP Default Login Username
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-03
Log source: windows/

Description:
Detects the default "UserName" used by the DiagTrackEoP POC

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 9,
    "TargetOutboundUserName": "thisisnotvaliduser"
  },
  "condition": "selection"
}

References:
  - https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L46
Sigma Detection Rule: Successful Overpass the Hash Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (source), Dominik Schaudel (rule)
Date: 2018-02-12
ATT&CK techniques: T1550.002
Log source: windows/

Description:
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 9,
    "LogonProcessName": "seclogo",
    "AuthenticationPackageName": "Negotiate"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html
Sigma Detection Rule: Admin User Remote Logon
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: juju4
Date: 2017-10-29
ATT&CK techniques: T1078.001, T1078.002, T1078.003
Log source: windows/

Description:
Detect remote login by Administrator user (depending on internal pattern).

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 10,
    "AuthenticationPackageName": "Negotiate",
    "TargetUserName|startswith": "Admin"
  },
  "condition": "selection"
}

References:
  - https://car.mitre.org/wiki/CAR-2016-04-005
Sigma Detection Rule: A Member Was Removed From a Security-Enabled Global Group
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Alexandr Yampolskyi, SOC Prime
Date: 2023-04-26
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects activity when a member is removed from a security-enabled global group

Detection logic:
{
  "selection": {
    "EventID": [
      633,
      4729
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633