new: Remote Management Tool - Ninite Execution From Suspicious Context & improve: End User Consent To Application - context, references, FP guidance

[Lorygold]

Summary of the Pull Request

Added Remote Management Tool - Ninite Execution From Suspicious Context, which is a deployment tool abused for silent software installation (T1072) and as a remote access foothold (T1219), and that the rule uses suspicious provenance to contain false positives typical of environments using Ninite legitimately.

Updated End User Consent with context, references, FP guidance`
The rule fires on every end-user consent, which is expected behaviour but leaves the analyst without context. This enriches the description to explain the illicit consent grant (consent phishing) threat model behind the event, adds the two authoritative Microsoft detection and mitigation references, replaces the empty "Unknown" false positive entry with concrete tuning guidance, and clarifies the title. No detection logic change: the high-fidelity new-terms logic cannot be expressed in stock Sigma and is documented as a SIEM-layer responsibility.

Changelog

new: Remote Management Tool - Ninite Execution From Suspicious Context
update: End User Consent

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @Lorygold 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server