Sigma detection rules, expert-reviewed

Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)

This rule detects execution of the AdFind command-line Active Directory query tool, frequently staged by ransomware operators for domain reconnaissance. Fog and Akira operators deployed adfind.exe following SonicWall SSL VPN compromise to enumerate the domain.

Malicious Notepad++ Updater Chain via gup.exe Spawning update.exe (via process_creation)

This rule detects the Notepad++ GUP updater gup.exe spawning update.exe, the NSIS-based infection chain seen in the nation-state Notepad++ supply-chain compromise. The trusted updater is subverted to launch a malicious installer that side-loads the Chrysalis payload.

Malicious DtlCrashCatch DLL Side-Loading via OneDrive Sync Service by SPECTRALVIPER

This rule detects the OneDrive.Sync.Service.exe process loading DtlCrashCatch.dll, a side-loaded and injected module used by the SPECTRALVIPER backdoor. This activity is associated with the OceanLotus (APT32) espionage campaign that abuses a trusted signed OneDrive binary for DLL search-order hijacking. Catching this specific side-load is important because it reveals code injection and stealthy execution under a legitimate process context.

Malicious Direct etcd Write to Kubernetes Registry via ETCDCTL_API (via process_creation)

This rule detects direct writes to the Kubernetes object store held in etcd by invoking etcdctl v3 against the /registry key space. Attackers who compromise etcd use this to inject privileged pods or hidden namespace resources that never pass through the kube-apiserver. Bypassing the API server evades admission controllers and audit logging while granting node and cluster takeover.

Masquerading Kimsuky Registry Run Key Persistence for Malware Loader (via registry_set)

This rule detects creation of a CurrentVersion Run autorun value named NetService or WindowsSecurityCheck, the persistence behavior used by the Kimsuky KimJongRAT loader to relaunch its PE and PowerShell payloads at logon. Adversaries leverage benign sounding run key names to survive reboots while masquerading as system services, making early detection critical for surfacing persistence before data collection.

Suspicious Download to Windows appcompat Directory via PowerShell

This rule detects PowerShell using Invoke-WebRequest to write an executable into the Windows appcompat directory as observed after Triofox CVE-2025-12480 exploitation. Attackers stage payloads such as SAgentInstaller.exe in unusual system paths to evade attention.

Malicious Remote Desktop Enablement via Netsh

This rule detects netsh enabling the Remote Desktop service in the firewall to open inbound RDP for lateral movement. This was observed during Obscura ransomware deployment. Opening RDP on hosts that normally block it extends the attacker foothold across the network.

Suspicious NirSoft Credential Recovery Tools Execution

This rule detects execution of the NirSoft credential recovery tools netpass.exe and WebBrowserPassView.exe. The Christmas Miracle actor dropped these utilities to extract stored network and browser passwords. Their presence on a server indicates active credential harvesting by an intruder.

Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)

This rule detects PowerShell reading the registry Applications key for mshta under the software classes hive using wildcarded paths, a lookup PEAKLIGHT performs to locate mshta for proxy execution. Programmatic resolution of the mshta binary path is an anti-analysis and living-off-the-land staging behavior.

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

This rule detects the command shell pattern used by Cobalt Strike's getsystem, in which cmd.exe echoes data into a named pipe to trigger SYSTEM token impersonation via a briefly created service. Cobalt Strike is among the most prevalent adversary tools in the Red Canary Threat Detection Report, and this privilege-escalation primitive is a high-fidelity signal of an active beacon. Detecting the echo-to-pipe command surfaces hands-on escalation.

Possible AppDomainManager Hijack via Application Config File (via file_event)

This rule detects creation of an update.exe.config application configuration file used by Screening Serpens for AppDomainManager injection with ETW disabled. The malicious config forces the .NET runtime to load an attacker assembly and blinds Event Tracing for Windows.

Suspicious ETW Bypass via PSEtwLogProvider Patching (via ps_script)

This rule detects PowerShell script content that reaches into the PSEtwLogProvider internal enabled flag to disable Event Tracing for Windows, an in-memory logging evasion used by the SEO poisoning infostealer. Patching this field blinds PowerShell script block telemetry. Legitimate scripts do not manipulate this private ETW provider field.

Renamed Execution of a Renamed Windows System Utility (via process_creation)

This rule detects a built-in Windows system utility running under a filename that does not match its embedded original binary name, exposing a mismatch between the PE OriginalFileName and the on-disk image. Renaming trusted utilities such as cmd, powershell, certutil or rundll32 is a defense-evasion technique highlighted in the Red Canary Threat Detection Report that lets adversaries slip past name-based detections and application controls. Alerting on the OriginalFileName-to-image mismatch surfaces the evasion regardless of the alias chosen.

Suspicious Expensive LDAP Query Reconnaissance

This rule detects Directory Service event 1644 recording expensive or inefficient LDAP search queries against a domain controller. This behavior matches LDAP-based reconnaissance where attackers issue broad filters to enumerate users, groups, and computers. A burst of expensive LDAP queries from unusual sources indicates active directory enumeration and should be correlated with the requesting host.

Suspicious Bitsadmin Transfer of CoinMiner Archive (via process_creation)

This rule detects bitsadmin.exe transferring a remote archive to download the XMRig CoinMiner as observed in the MS-SQL intrusion. Bitsadmin transfer jobs pulling zip payloads from external hosts are a known living off the land ingress technique.