Sigma detection rules, expert-reviewed

Suspicious Child Process Spawned by IIS Worker Process w3wp

This rule detects the IIS worker process w3wp.exe spawning a command interpreter or scripting host, a strong indicator of web exploitation or webshell activity such as the ViewState deserialization abuse that delivered the TOLLBOOTH IIS module. Command shells launched from the web server are rarely legitimate.

Suspicious Secret Scanning with trufflehog Verified Results

This rule detects trufflehog being executed to scan the local filesystem for verified secrets and emit JSON output, the credential-harvesting behavior of the Shai-Hulud npm supply-chain worm. The worm runs trufflehog on compromised developer machines to collect cloud and registry tokens for further spread.

Suspicious Active Directory Database Theft via ntds.dit Access

This rule detects command lines that reference the ntds.dit Active Directory database alongside ntdsutil or volume shadow copy operations used to extract it. Copying ntds.dit from a domain controller yields the password hashes for every domain account.

Malicious LSASS Memory Dump via procdump

This rule detects procdump being run against the lsass.exe process to capture a full memory dump, from which credentials can be extracted offline with tools such as mimikatz. This is one of the most common OS credential-dumping techniques.

Malicious Registry Hive Dump via reg save of SAM SYSTEM SECURITY

This rule detects reg.exe being used to export the SAM, SYSTEM, or SECURITY registry hives to disk, a classic offline credential-dumping step. Attackers copy these hives to extract local account password hashes and LSA secrets away from the live system.

Suspicious Wireless Credential Theft via netsh wlan Key Export

This rule detects netsh being used to display saved wireless profiles with cleartext keys, a credential-harvesting step performed by NOVABLIGHT. Exporting stored Wi-Fi passwords in the clear gives adversaries reusable network credentials.

Suspicious Chrome Launch with Remote Debugging for Credential Theft

This rule detects a Chromium-based browser launched with a remote debugging port or pipe argument, a technique used by EddieStealer and similar infostealers to drive the browser over the DevTools protocol and extract saved passwords and cookies. Remote debugging flags are rarely set by end users and indicate automated browser credential theft.

Suspicious Python Loader Execution from Public Directory

This rule detects a Python interpreter executing an __init__.py loader from a user Public directory, the staging pattern used in the DPRK Bit-By-Bit intrusion to run a malicious YAML deserialization payload. Python execution from a shared Public path is atypical and indicates malware staging and execution.

Suspicious PowerShell Encoded Command Execution

This rule detects powershell.exe or pwsh.exe invoked with an encoded command parameter, a technique used to obfuscate scripts and command-and-control instructions during post-exploitation and exfiltration. Encoded commands hide intent from casual inspection and are frequently abused by malware and offensive frameworks.

Suspicious runas NETONLY for Access Token Manipulation

This rule detects use of runas with the netonly flag, an access token manipulation technique detailed by Elastic where new network credentials are applied without validating them locally. Attackers use this to run tools under alternate credentials for lateral movement while the local session identity is unchanged. Interactive netonly logons outside of administrative jump host workflows can indicate credential abuse.

Suspicious Credential Dump via Registry Hive Save

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to disk, an OS credential dumping technique used in the REF7707 campaign to harvest secrets alongside ntds.dit theft. Exporting these hives lets an attacker extract local account hashes and boot keys offline. Saving protected hives is rarely part of normal administration and indicates credential access.

Suspicious Renamed Windows Debugger CDB Execution

This rule detects execution of the Microsoft console debugger CDB under a renamed file name, a defense evasion technique seen in the REF7707 campaign. CDB is a signed LOLBin that can launch arbitrary commands and shellcode so attackers rename it to evade name based detection. A mismatch between the original file name CDB.exe and the on-disk image name surfaces this abuse.

Suspicious Access To Chrome Elevation Service COM Object via Katz Stealer

This rule detects a handle to the Chrome elevation service object being obtained by an unexpected process which infostealers abuse to decrypt application-bound encrypted cookies through the elevated COM service. Adversaries invoke the GoogleChromeElevationService to recover the master key protecting stored credentials and session cookies.

Suspicious Chrome Launched With Remote Debugging Port For Cookie Theft

This rule detects chrome.exe started with a remote debugging port argument which MaaS infostealers use to attach over the DevTools protocol and read decrypted cookies and session tokens after Chrome application-bound encryption defenses. Adversaries drive a debug-enabled browser instance to harvest authenticated session material without triggering the standard credential prompts.

Suspicious Python Executing Staged Script From Temp Directory via DPRK Pyperclip Loader

This rule detects a Python interpreter spawning a child process from a file written into the system temporary directory which mirrors the DPRK malicious Pyperclip module that decodes a base64 blob to a temp script and executes it via subprocess. Adversaries stage and run obfuscated Python payloads from temp to retrieve and execute second stage command and control code.