Sigma detection rules, expert-reviewed

Suspicious Hidden Local Account via SpecialAccounts UserList Registry Value (via registry_set)

This rule detects a UserList value written under Winlogon SpecialAccounts to hide a local account from the Windows sign-in screen, a defense-evasion behavior MuddyWater uses after creating a covert admin account. Adversaries leverage this registry hiding so their persistent account stays invisible to interactive users.

Suspicious TightVNC Server Installation as a Service

This rule detects the TightVNC server tvnserver.exe installed with the -service argument, an unattended remote access mechanism observed in a Huntress-tracked Tiflux campaign that deployed stealth VNC tooling for persistent control. Registering the VNC server as a service enables silent boot-time remote access. Service installation of hidden VNC tooling on endpoints is characteristic of attacker remote access rather than sanctioned support software.

Malicious IIS Worker Process Spawning Command Shell via SharePoint ToolShell (via process_creation)

This rule detects the SharePoint IIS worker process w3wp.exe spawning command interpreters or scripting hosts, a hallmark of web shell execution. Exploitation of CVE-2025-53770 (ToolShell) drives w3wp to launch cmd or PowerShell for post-exploitation, indicating server-side remote code execution.

Suspicious Linux Host Reconnaissance via Whoami and Uname by UAT-7290

This rule detects a shell one-liner echoing the current user together with kernel and machine details from uname. UAT-7290 uses this command to profile compromised Linux hosts during initial access. Combined user and system enumeration is a common precursor to deploying tailored malware.

Suspicious Active Directory LDAP Reconnaissance via ADSearch (via process_creation)

This rule detects execution of the ADSearch tool using its search and LDAP-filter arguments to query Active Directory for users, groups and computers. ADSearch is a discovery utility observed in intrusions profiled by the Red Canary Threat Detection Report, used to map the directory ahead of privilege escalation and lateral movement. Detecting its query invocation surfaces adversary reconnaissance regardless of the binary name.

Suspicious AutoIt Script Execution of Compiled a3x Payload

This rule detects the AutoIt interpreter executing a compiled a3x script from a user writable location. Loaders such as DarkGate drop a renamed AutoIt binary alongside an obfuscated a3x script to decrypt and run shellcode while blending in with legitimate automation tooling.

Firewall Rule Manipulation via AuthorizedApplications Registry List

This rule detects modification of the firewall AuthorizedApplications List registry key, the technique the Phorpiex downloader uses to whitelist its own binary for outbound access. Adding a program to this legacy firewall exception list enables command-and-control while evading network defenses.

Malicious Pikabot Rundll32 Loading DLL with Enter Export

This rule detects rundll32.exe loading a DLL and calling the Enter export, the loader execution used by Pikabot after a downloaded DAT payload is renamed to a DLL. Running the module through rundll32 proxy execution hides the malicious code under a trusted signed binary.

Suspicious Kimsuky RDP Wrapper Keylogger Output in ProgramData (via file_event)

This rule detects the creation of keylogger output files named joeLog.txt or jLog.txt directly under ProgramData as used by the Kimsuky RDP Wrapper campaign. These fixed filenames in the ProgramData root are strong indicators of the keystroke capture component.

Suspicious Failed DNS Server Zone Transfer for Enumeration Purposes (via dns-server)

This rule detects exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.

Suspicious GPINFO Data Store in ODBC Registry Key by Diplomatic Specter

This rule detects registry writes to a GPINFO value under the WOW6432Node ODBC hive, a location the Operation Diplomatic Specter actor abuses to stash configuration and collected data away from common inspection paths. Reusing a benign-looking ODBC key hides operational state within normal software structures. Detecting this write exposes covert data staging tied to the espionage campaign.

Suspicious Termination of Security Tooling via taskkill or sc delete

This rule detects taskkill or sc.exe being used to stop or delete Sysmon, SentinelOne, or other endpoint security services, matching the impairment activity in the Defence Impairment intrusion. Adversaries kill and remove EDR and monitoring agents to operate without detection before credential theft and lateral movement. Targeting named security services with process or service control utilities is a high-confidence evasion signal.

Suspicious Run Key Persistence Referencing Public or Default User Path

This rule detects creation of a CurrentVersion Run registry value whose data points to an executable staged under C:\Users\Public or the Default User profile. Ryuk ransomware drops its payload into these world-accessible directories and registers autorun persistence pointing there. Legitimate software rarely autoruns binaries from these locations, making this combination a high-confidence indicator.

Possible Rclone MEGA Exfiltration via DNS Query to MEGA Storage Endpoint

This rule detects DNS resolution of MEGA cloud storage upload endpoints used by Rclone during exfiltration. NCC Group observed Rclone transferring stolen data to MEGA userstorage endpoints. Traffic to consumer cloud storage from server or workstation contexts often indicates unauthorized data movement out of the environment.

Suspicious Windows Defender Exclusion Added via Add-MpPreference

This rule detects use of Add-MpPreference to register Microsoft Defender exclusion paths extensions or processes which the TorNet backdoor campaign performs to prevent detection of its payloads before execution. While administrators occasionally set exclusions attacker driven exclusion changes are a common defense evasion step that should be validated against change management.