Sigma detection rules, expert-reviewed

Malicious PrintNightmare Privilege Escalation via Invoke-Nightmare

This rule detects the Invoke-Nightmare PowerShell cmdlet used to exploit the PrintNightmare vulnerability for local privilege escalation, as observed in SnapMC intrusions before data theft. Invocation of this public exploit tooling reliably indicates an attempt to gain SYSTEM privileges through the print spooler.

Suspicious Service NetDnsActivatorSharing Creation via Process Creation

This rule detects creation of a Windows service named NetDnsActivatorSharing via sc.exe, a persistence artifact of the GoldenJackal air-gapped toolset. The name imitates a plausible networking service to evade casual review. This indicates service-based persistence by an espionage actor targeting isolated networks.

Malicious BYOVD Driver Signed by Revoked Certificate Load (via image_load)

This rule detects the loading of a kernel driver signed with the revoked or expired certificates reused by the AVKiller EDR killer shared across multiple ransomware operators. The driver carries a randomized name and fake CrowdStrike version information but is signed by the revoked Changsha Hengxiang or expired Fuzhou Dingxin certificates, a strong indicator of bring your own vulnerable driver abuse.

Suspicious RegAsm Process Hollowing for DarkCloud Stealer

This rule detects RegAsm.exe launching outside of normal .NET build or install workflows. The DarkCloud stealer infection chain injects its payload into a hollowed RegAsm.exe process to execute under a trusted Microsoft binary. RegAsm running without a legitimate .NET tooling parent is a strong process hollowing indicator.

Suspicious Prefetch Deletion for Anti-Forensics

This rule detects deletion of files from the Windows Prefetch directory, an anti-forensic action The Gentlemen ransomware used to remove execution artifacts alongside Defender logs. Clearing Prefetch data is a deliberate attempt to hinder investigation and indicates active cleanup by an intruder.

Suspicious Sisfader RAT Loader DLL Written to Local AppData

This rule detects creation of a DLL named to appear as a helper component in the user Local AppData directory which the Sisfader RAT drops as its loader. Observed in NCC Group research on CVE-2017-8570 RTF documents delivering the Sisfader RAT. A helper-named DLL staged in a user profile directory is an indicator of masqueraded malware persistence.

Malicious Reverse Tunnel Agent Execution with Hidden Server Flags

This rule detects execution of agent.exe with -server and -hide command-line flags, the reverse tunnel implant used in a Huntress-investigated Nightmare-Eclipse intrusion that connected to staybud.dpdns.org over port 443. The -hide flag conceals the agent window while -server points to the attacker relay, establishing a yamux-based reverse tunnel. This flag combination reflects covert command-and-control tunneling.

Suspicious KeePass Configuration Discovery via PowerShell Script

This rule detects execution of the Find-KeePassConfig PowerShell function, used by the ransomware actor Storm-0501 to locate KeePass password database configuration files for credential theft. Discovering KeePass configs is a precursor to extracting master keys and stored secrets from password vaults.

Malicious LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, a LOLBIN LSASS dumping technique documented by Huntress. Attackers first resolve the LSASS process id via tasklist and then dump its memory to harvest plaintext credentials and hashes. Because comsvcs MiniDump has no legitimate administrative use, this is a high-confidence credential-theft signal.

Suspicious NightSpire Encryptor Execution Producing nspire Extension via process_creation

This rule detects execution of the enc.exe encryptor associated with NightSpire ransomware or command lines referencing the .nspire extension it appends. This activity represents the encryption stage of the intrusion where victim files are locked, and its detection enables rapid response to limit ransomware impact.

Suspicious Wscript Spawning Rundll32 to Load Remote DLL (via process_creation)

This rule detects wscript.exe launching rundll32.exe, an unusual parent-child relationship used by the Strela Stealer JavaScript loader to execute a WebDAV-hosted DLL payload. Legitimate scripts rarely invoke rundll32 in this manner.

Suspicious Script Interpreter Command Recorded in Explorer RunMRU History (via registry_set)

This rule detects the Windows Run dialog history under the Explorer RunMRU registry key recording a script-interpreter command such as mshta, powershell, or curl, the residual artifact left when a victim pastes a ClickFix command during this Booking.com themed phishing campaign. Adversaries drive users to run attacker-supplied commands via the Run dialog, so an interpreter invocation captured in RunMRU is a reliable sign of ClickFix-style execution.

Suspicious Python Backdoor Staging in SystemServices Folder (via file_event)

This rule detects creation of a Python script named svc.py inside a SystemServices directory under the local application data path. The DEEP#DOOR campaign staged its Python backdoor and credential stealer at this location.

Suspicious Command Shell Spawned by Service or Remote Execution Parent

This rule detects a command shell spawned by WMI provider host, PsExec, or the SQL Server engine, parent processes that indicate remote or service-based command execution rather than interactive use. These lineages were highlighted as reliable signals of living-off-the-land abuse during lateral movement and post-exploitation. Shells launched from these parents warrant review for hands-on-keyboard activity.

Suspicious Batch File Persistence in Startup Folder

This rule detects creation of the WindowsSecure.bat file inside the Windows Startup folder, the persistence mechanism used by the Snake Python infostealer to survive reboots. Attackers place a batch launcher here so the stealer re-executes at every user logon. A batch file dropped into a Startup directory is a reliable autostart persistence indicator.