SAP ETD - Synch investigations

MediumSigmaHQ

Disable Internal Tools or Feature in Registry

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

T1112

Written by: frack113Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

HighSigmaHQ

Suspicious Windows Service Tampering

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

T1489T1685

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Rundll32 Execution With Uncommon DLL Extension

Detects the execution of rundll32 with a command line that doesn't contain a common extension

T1218.011

Written by: Tim SheltonAttributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Registry Tampering Of Internal Tools Settings

Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools

T1112

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

MediumSigmaHQ

Shell Spawned by Celery Worker Process

Detects a system shell interpreter being spawned directly by a Celery worker process. This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context, which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.

T1059.004

Written by: Jennifer BatinaAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 18, 2026

UnknownMicrosoft Sentinel analytics

Suspicious Enumeration using Adfind Tool

Query detects Adfind tool use for domain reconnaissance, regardless of executable name, focusing on DC and ADFS servers, to spot potential adversary activity.

T1059T1069T1074T1087T1201+1 more

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

New Child Process of W3WP.exe

Hunting Query detects unusual child processes of w3wp.exe not seen in 14 days, signaling potential web server compromise and web shell installation.

T1203

Licence: MIT License
Published: Oct 17, 2026

HighMicrosoft Sentinel analytics

Scheduled Task Hide

Identifies malware hiding scheduled tasks by deleting the SD (Security Descriptor) value, making tasks disappear from schtasks /query and Task Scheduler. Enable registry auditing policy and auditing on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree. Reference: https://www.microsoft.com/en-us/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ Reference: https://learn.microsoft.

T1562

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

AD FS Remote Auth Sync Connection

Identifies suspicious AD FS authentication by correlating Security events from "AD FS Auditing" with Windows Filtering Platform (WFP) events for incoming port 80 traffic. This may indicate a threat actor abusing AD FS replication services to obtain configuration settings and sensitive information such as AD FS certificates. Enable AD FS auditing on the AD FS server before using this query. References: https://learn.microsoft.

T1005

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

SSH - Potential Brute Force

Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events for ToR proxies

Check for Squid proxy events associated with common ToR proxies. This query presumes the default squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1008T1090

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools. This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer folder count above threshold

Identifies SFTP File Transfers with distinct folder count above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

SFTP File transfer above threshold

Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel.

T1020

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

NRT Squid proxy events related to mining pools

Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/

T1102

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Failed logon attempts in authpriv

Identifies failed logon attempts from unknown users in Syslog authpriv logs. The unknown user means the account that tried to log in isn't provisioned on the machine. A few hits could indicate someone attempting to access a machine they aren't authorized to access. If there are many of hits, especially from outside your network, it could indicate a brute force attack. Default threshold for logon attempts is 15.

T1110

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Rare Windows Firewall Rule updates using Netsh

This query searches for rare firewall rule changes using netsh utility by comparing rule names and program names from the previous day.

T1204

Licence: MIT License
Published: Oct 17, 2026

UnknownMicrosoft Sentinel analytics

Download of New File Using Curl

Threat actors may use tools such as Curl to download additional files, communicate with C2 infrastructure, or exfiltrate data. This query looks for new files being downloaded using Curl.

T1071

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

Windows Binaries Lolbins Renamed

This query detects the execution of renamed Windows binaries (Lolbins). This is a common technique used by adversaries to evade detection. Ref: https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin

T1059

Licence: MIT License
Published: Oct 17, 2026

MediumMicrosoft Sentinel analytics

WDigest downgrade attack

When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory. Ref: https://www.microsoft.com/en-us/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/

T1003

Licence: MIT License
Published: Oct 17, 2026

LowMicrosoft Sentinel analytics

Subscription moved to another tenant

This detection uses AzureActivity logs (Security category) to identify when a subscription is moved to another tenant. A threat actor may move a subscription into their own tenant to circumvent local resource deployment and logging policies. Once moved, threat actors may deploy resources and perform malicious activities such as crypto mining. This is a technique known as "subscription hijacking". More information can be found here: https://techcommunity.microsoft.

T1496

Licence: MIT License
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise User Invite Sent

Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

T1136T1136.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Domain Created

Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Trigger Changed

Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.

T1053

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Custom Agent Published

Detects ChatGPT Enterprise custom-agent publish events (`agent_published`). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.

T1176

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

T1176T1213

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Codex Access Token Created

Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing `expires_at` as higher priority during triage.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise App Authentication Linked

Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

HighElastic detection rules

OpenAI ChatGPT Enterprise Account Owner Role Assigned

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.

T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 17, 2026

Detection rules

SAP ETD - Synch investigations

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules