Sigma detection rules, expert-reviewed

Suspicious SocGholish Domain User Enumeration via net1

This rule detects enumeration of the domain users group using net1 with the /domain switch. This behavior was observed in SocGholish fake update intrusions during hands-on-keyboard reconnaissance. Attackers use it to map account membership before lateral movement toward victim peers.

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

This rule detects cmd.exe spawned by the WMI provider host with a command line referencing the ADMIN administrative share, a remote execution pattern Volt Typhoon uses to run commands and stage output over WMI. Combining a WMI parent with administrative share access reflects remote lateral movement rather than routine local scripting, making it a strong signal of interactive intrusion activity.

OpenSSH Server Firewall Configuration on Windows - Command (via process_creation)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

VSS Backup Deletion - WMI (via process_creation)

This rule detects delete existing VSS backup.

Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation

This rule detects WindowsSandbox.exe launched with a .wsb configuration file, the technique MirrorFace uses in Operation AkaiRyu to run AsyncRAT inside Windows Sandbox and evade host-based monitoring. Interactive Windows Sandbox use driven by a dropped .wsb config is uncommon on managed endpoints. This indicates sandbox-based evasion hosting a remote access trojan.

Malicious Khmer Shadow DLL Sideloading via VMwareNamespaceCmd Loading vmtools (via image_load)

This rule detects the signed VMwareNamespaceCmd binary loading a vmtools DLL from outside the trusted VMware install path, the side-loading behavior used to run the Khmer Shadow loader against Cambodian government entities. Adversaries drop a malicious vmtools.dll beside a relocated VMware binary to execute under a trusted process. Loads originating outside Program Files expose the sideloaded implant.

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

This rule detects a process whose original file name is PowerShell but which executes under the wt.exe Windows Terminal file name. The axios supply chain payload renamed powershell.exe to wt.exe to evade name-based detection, so a mismatch between the internal PowerShell identity and a wt.exe image name indicates a masqueraded interpreter.

Suspicious SMB Admin Share Accessed (via security)

This rule detects connect to the administrative SMB share.

Malicious Reverse SSH Tunnel via Plink for RDP Forwarding

This rule detects use of the Plink SSH client to establish a reverse tunnel that forwards local RDP back to attacker infrastructure which Conti operators use for persistent remote access. Observed in NCC Group research on Conti operations after the leaks using a renamed Plink binary over port 53. Reverse RDP tunneling through SSH is a strong indicator of hands-on-keyboard intrusion.

Suspicious Plink Reverse Tunnel Establishment

This rule detects a plink or renamed SSH client establishing a reverse port-forward tunnel using the -R option. UAT-5647 deployed a renamed plink binary such as iestatus.exe with -R to build a reverse SSH tunnel back to attacker infrastructure. Reverse SSH tunnels give attackers persistent interactive access and a pivot channel that bypasses inbound firewall restrictions.

Suspicious NTUSER.MAN Mandatory Profile File Created for Logon Persistence (via file_event)

This rule detects creation of an NTUSER.MAN mandatory user profile file inside a local user profile directory, a logon-persistence technique attributed to APT32 by 360 Advanced Threat Research in which a crafted binary registry hive is dropped as NTUSER.MAN so malicious autostart entries execute at user logon without administrative rights. Adversaries abuse the mandatory profile mechanism to load an attacker-built HKCU hive that never passes through the registry API, evading registry-callback based monitoring.

In-Memory Process Injection via Mavinject INJECTRUNNING (via process_creation)

This rule detects mavinject.exe called with the INJECTRUNNING flag, which injects a DLL into a running process through a signed Microsoft binary, a stealthy execution and defense-evasion technique. Mavinject abuse is tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces trusted-binary process injection.

Suspicious Registry Query for Stored Credentials (via process_creation)

This rule detects reg.exe querying registry locations for stored passwords or autologon credentials, an unsecured-credentials technique used to harvest plaintext secrets left in the registry. Searching the registry for credentials is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces credential discovery on the host.

Suspicious Hidden PowerShell Download Cradle via ClickFix (via process_creation)

This rule detects a hidden window PowerShell process invoking DownloadString to pull a remote second stage, matching the HarborWatch ClickFix chain that runs a base64 command to fetch code from a remote text file. A hidden PowerShell window combined with a web download is a strong indicator of scripted delivery.

Suspicious Run Key Persistence Pointing to Documents Folder (via registry_set)

This rule detects creation of a HKCU Run key whose value points to an executable hidden inside a user Documents subfolder, a persistence pattern used by the BundleBot stealer. Legitimate software installs to Program Files, so a Run entry launching a binary from the user Documents tree is a strong sign of malware autostart.