Sigma detection rules, expert-reviewed

Suspicious External IP Lookup to ipify Service (via dns_query)

This rule detects DNS resolution of the ipify external IP-lookup service, which adversaries query at the start of instant-messaging command and control to discover the victim public address. Malware pairs this lookup with sessions to Discord or Telegram APIs to fingerprint the environment before beaconing. The lookup is dual-use, so correlate with unsigned or masquerading binaries for higher confidence.

Malicious Mimikatz Malicious Security Package (SSP) Exfiltrates Cleartext Passwords in File (via file_event)

This rule detects loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.

Suspicious Regsvr32 Loading DLL From Temp Directory (via process_creation)

This rule detects regsvr32 executing silently against a DLL located in the temp directory which the SneakyChef loader chain uses to register and run its SugarGh0st payload. Silent regsvr32 execution of a non-standard DLL path is a signed proxy execution technique that bypasses application allowlisting.

Malicious BlackBeard SCR Payload Execution (via process_creation)

This rule detects execution of WebDeepPlayer.scr, a screensaver-disguised executable used to deliver the BlackBeard payload in Boggy Serpens operations. The .scr extension conceals an executable that runs on user interaction, so its launch indicates delivery of the malware to the endpoint.

Malicious MuddyWater ManageOnDriveUpdater Scheduled Task Persistence

This rule detects creation of a scheduled task named ManageOnDriveUpdater, the persistence mechanism used by the MuddyWater MuddyViper implant. The task name imitates a OneDrive update service to blend in, and its registration signals attacker-established persistence following a spearphishing intrusion.

Suspicious IMDS IAM Credential Retrieval From Container Workload

This rule detects a command line that queries the EC2 Instance Metadata Service credentials path 169.254.169.254 latest meta-data iam security-credentials to retrieve IAM role credentials. In EKS clusters where IMDSv2 is not enforced, a compromised pod uses this request to steal the worker node role credentials and escalate beyond the pod identity. This matters because it lets container workloads impersonate the underlying node and reach broader AWS permissions.

Suspicious Network Share Enumeration via SharpShares

This rule detects execution of the SharpShares tool which enumerates accessible network shares across the domain as seen in the WithSecure lab where the operator compiled and ran SharpShares to map reachable shares. Broad share enumeration is a reconnaissance step used to locate sensitive data and lateral movement paths which makes it a useful discovery detection.

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

This rule detects execution of a Chisel client establishing a reverse SOCKS tunnel over HTTP. UAT-9686 deploys Chisel alongside a reverse SSH tunnel to maintain remote access to compromised Cisco email appliances. Reverse tunnels let an actor pivot into internal networks while blending with web traffic.

Malicious Credential Exfiltration to webhook.site

This rule detects curl posting data to a webhook.site endpoint, the exfiltration channel used by the Shai-Hulud worm to send harvested secrets to attacker-controlled webhooks. The worm labels these requests to correlate stolen data from each compromised host.

Suspicious Office Application Spawning Script Interpreter (via process_creation)

This rule detects Excel or Word spawning a scripting interpreter such as wscript or powershell which the DarkGate remote template injection chain triggers to move from a malicious document to a VBS and PowerShell stager. Office applications launching script hosts is a hallmark of macro and template based initial access.

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

This rule detects winword.exe spawning mshta.exe, splwow64.exe, powershell.exe or cmd.exe, the exploitation chain of CVE-2023-36884 by Storm-0978. A weaponized document triggers these anomalous child processes to fetch and run a RomCom-like backdoor after the victim opens the lure.

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

This rule detects cmd.exe reading and executing content from an NTFS alternate data stream attached to a decoy PDF using input redirection. TA397 delivered LNK files that ran a hidden PowerShell stage stored in a PDF ADS such as ~tmp.pdf.

Suspicious Executable Launched from Public Music Folder

This rule detects process execution from the C:\Users\Public\Music directory, a staging path used by RansomHub affiliates to run randomly named ransomware encryptor binaries. Legitimate applications rarely execute from the public Music folder, so execution there is a strong indicator of staged malware.

EtherRAT Node.js Backdoor Execution via Headless Conhost (via process_creation)

This rule detects the EtherRAT backdoor launched through conhost.exe in headless mode running a bundled Node.js payload from the hidden MicrosoftSltt directory, an execution behavior observed in The Gentlemen ransomware intrusions using Ethereum smart-contract C2. Adversaries leverage the signed conhost host to run a Node.js runtime and blend malicious JavaScript execution into normal process activity.

Malicious Veeam Credential Dumping Script Execution

This rule detects execution referencing a PowerShell script named to extract stored Veeam backup credentials which ransomware operators use to obtain privileged accounts. Observed in NCC Group research into active ransomware families pairing Mimikatz with a Veeam credential script. Harvesting backup credentials enables lateral movement and recovery sabotage which makes this a strong credential-access signal.