Sigma detection rules, expert-reviewed

Suspicious Firewall Rule Opening Backdoor Port 49683 via Process Creation

This rule detects a netsh advfirewall command that adds a rule for local port 49683. ToddyCat opens this specific port to expose its passive UDP backdoor (aspnet.exe) for command-and-control, so a firewall rule referencing it indicates attacker setup.

Suspicious Service Creation Masquerading as FortiGateUpdate (via process_creation)

This rule detects sc.exe creating a service named FortiGateUpdate whose binary path launches svchost with a service grouping switch. This behavior was observed in Cyber Partisans activity that masqueraded a DNSCat2 tunneling service as a Fortinet update to blend into industrial environments. Detecting the masqueraded service creation exposes the persistence stage of the intrusion.

Suspicious wscript Execution of Short-Name JavaScript from AppData (via process_creation)

This rule detects GootBot persistence where a scheduled task runs wscript.exe against a second-stage JavaScript file using its short name ending in a tilde-one JS pattern inside an AppData subfolder. Execution of a short-name js from AppData by the script host is characteristic of the GootLoader chain. Legitimate software rarely launches scripts this way.

Obfuscated Firewall Configuration Enumerated - Command (via process_creation)

This rule detects extract current Windows firewall configuration to prepare an attack.

Enable WDigest using PowerShell (ps_module)

Rule to detect registry modifications to enable WDigest using powershell script modules.

Suspicious Hidden Local Account Creation Via Net User

This rule detects creation of a local account whose name ends with a dollar sign using net user with the add flag. DragonRank created a hidden admins$ local account to maintain access on compromised web servers. Appending a trailing dollar sign hides the account from casual net user enumeration making this a stealthy persistence and account-manipulation move.

Suspicious LDAP Enumeration of Certificate Templates (via security)

This rule detects LDAP queries enumerating pKICertificateTemplate objects, an AD CS reconnaissance step used to find misconfigured templates vulnerable to certificate-based privilege escalation. This activity commonly precedes malicious certificate requests observed in Security Events 4886 and 4887.

Suspicious Run Key Persistence via reg add

This rule detects reg.exe writing a value under a CurrentVersion Run or RunOnce key, a common autorun persistence mechanism. Adversaries add these entries so their payload executes automatically at user logon, and living-off-the-land toolkits frequently script this step.

Suspicious VMware and Cortex Binaries Executing From User-Writable Paths

This rule detects processes named after legitimate VMware guest tools or the Palo Alto Cortex updater running from AppData, Temp, or other user-writable directories. Actors in the Africa financial-sector campaign renamed their PoshC2 tooling to vmtoolsd.exe, vm3dservice.exe and CortexUpdater.exe to blend in. Trusted binary names executing from non-standard paths indicate masquerading.

Suspicious Executable Running from PerfLogs Directory

This rule detects execution of a binary from the Windows PerfLogs directory which ransomware operators use as a staging location for tooling. Observed in NCC Group research into active ransomware families dropping a min.exe binary into the PerfLogs directory. Execution from PerfLogs is highly abnormal which makes it a useful indicator of stager or tooling activity.

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating trusted domains, an Active Directory discovery step used to map trust relationships for lateral movement. This was observed after SonicWall VPN exploitation preceding Akira ransomware. Domain trust enumeration from user context or servers often marks hands-on-keyboard reconnaissance.

Suspicious RunMRU Entry Containing Script Download from ClickFix

This rule detects a RunMRU history value that records a scripted download command such as PowerShell or mshta invoking a remote resource. ClickFix social engineering has the victim paste the command into the Run dialog which leaves the payload in RunMRU before it is cleared. Script interpreters and download utilities in the Run dialog history strongly suggest a ClickFix style delivery.

Suspicious Scheduled Task Creation Pointing to AppData (via process_creation)

This rule detects creation of a scheduled task whose action points to an executable inside the user AppData directory. Nokoyawa-linked loaders register an hourly task in AppData Roaming to maintain persistence for IcedID and follow-on tooling. Scheduled tasks launching binaries from AppData are unusual and a common persistence mechanism for commodity loaders.

Malicious Defender Real-Time Monitoring Disable via Registry

This rule detects the DisableRealtimeMonitoring registry value being enabled to turn off Microsoft Defender real-time scanning. This was observed during Cephalus ransomware deployment alongside service stops and exclusions. Disabling real-time monitoring removes on-access detection so the encryptor can run freely.

Suspicious MSHTA Remote HTML Application Execution via Amatera Stealer ClickFix

This rule detects mshta.exe launching an HTML application from a remote URL, the ClickFix delivery step for the Amatera Stealer 4.0.2 variant. The victim is lured into running a copied command that pulls an HTA from attacker infrastructure. Remote mshta execution is a common living-off-the-land loader technique and should be reviewed against expected administrative activity.