Skip to content

Open library

Rule library

Every rule carries its log-source requirements, its documented false positives and the atomic test that proves it fires. If a rule here has no false-positive section, it is not finished and we have not shipped it.

Severity
Platform
Language

26 of 26 rules

critical EQL

Admin Share Write Followed by Execution

A file lands on ADMIN$ or C$ over SMB and something runs from that path minutes later. Either half is noisy; the sequence is the classic PsExec shape.

T1021.002 Windows 2026-09-13
critical KQL

CloudTrail Logging Stopped or Trail Deleted

Someone blinding the audit trail. One of the highest-signal cloud detections you can deploy - near-zero noise outside planned change windows.

T1562.008 AWS 2026-07-28
critical Sigma

DCSync - Replication From a Non-DC Host

Directory replication rights exercised by a principal that is not a domain controller. If this fires for real, the domain is gone.

T1003.006 Windows 2026-09-19
critical KQL

MFA Method Registered After a Risky Sign-In

Correlates a risky sign-in with an authentication-method registration minutes later - the fingerprint of account takeover establishing persistence.

T1098.005 Entra ID 2026-08-30
critical SPL

Security Service Stopped or Disabled

EDR, backup or logging services being stopped. Requires two or more in the same window, which separates pre-encryption housekeeping from ordinary service churn.

T1489 Windows 2026-09-07
critical Sigma

Suspicious Handle Access to LSASS

A non-allowlisted process opening LSASS with memory-read rights - the core primitive behind Mimikatz, comsvcs.dll dumping and most credential theft tooling.

T1003.001 Windows 2026-09-02
critical Sigma

UAC Bypass via Fodhelper Registry Hijack

Creation of the HKCU ms-settings shell open command key, the hijack that makes auto-elevating fodhelper.exe run an attacker binary with no consent prompt.

T1548.002 Windows 2026-09-06
critical Sigma

Volume Shadow Copy Deletion

The last quiet moment before ransomware encrypts. vssadmin, wmic or wbadmin destroying recovery points should page a human, not fill a queue.

T1490 Windows 2026-09-08
critical SPL

Web Server Process Spawning a Shell

The post-exploitation tell. A web server should never parent a shell; when it does, the exploit already worked and you are looking at what came next.

T1190 Windows / Linux 2026-09-17
critical Sigma

Windows Event Log Cleared

The Security, System, PowerShell or Sysmon log being cleared. Rarely legitimate outside a change window, and one of the few cases where the missing log is the evidence.

T1070.001 Windows 2026-09-12
high KQL

Bulk Object Download From Cloud Storage

Reads are normal. Reads at volume by one principal across many objects in an hour, excluding principals whose baseline already moves data in bulk, are not.

T1567.002 AWS 2026-09-15
high KQL

Interactive RDP Fan-Out From a Single Source

One source opening interactive sessions to many hosts in an hour. Counts distinct destinations, because admins revisit a few machines and lateral movement touches many once.

T1021.001 Windows 2026-09-09
high Sigma

Remote Process Creation via WMI Win32_Process

WmiPrvSE.exe spawning a child is the server side of wmic process call create. The parent relationship is the detection; the command line is context.

T1047 Windows 2026-09-08
high Sigma

Reverse Shell via /dev/tcp

Bash redirecting a shell to a network socket. No binary dropped, no file on disk - a common next step after web application compromise.

T1059.004 Linux 2026-09-18
high KQL

S3 Bucket Policy Opened to Public

Public-ACL or wildcard-principal changes on a bucket. Usually a misconfiguration, occasionally staged exfiltration.

T1530 AWS 2026-07-03
high Sigma experimental

WMI Event Subscription Persistence

The FilterToConsumerBinding that turns WMI into fileless, reboot-surviving execution. Rare in most estates, which is exactly what makes it high-fidelity.

T1546.003 Windows 2026-09-20
medium KQL

Password Spray Against Entra ID

Low-and-slow failures across many accounts from few source IPs - tuned on distinct-user count rather than raw failure volume.

T1110.003 Entra ID 2026-08-12
medium Sigma experimental

Remote Execution via WinRM Host Process

wsmprovhost.exe spawning a child means a remote PowerShell session ran something here. Expected from jump hosts, suspicious from anywhere else.

T1021.006 Windows 2026-09-11