Sigma detection rules, expert-reviewed

Malicious AppDomainManager Injection via MyAppDomainManager DLL Load

This rule detects a .NET process loading a module named MyAppDomainManager.dll, the hijack DLL used by CL-STA-1062 to abuse the AppDomainManager configuration in chrome_setup.exe.config and run the TinyRCT backdoor inside a trusted process. Catching this load reveals CLR AppDomainManager injection used for defense evasion and stealthy code execution.

Malicious File Encryption via Kraken Ransomware Encryptor Binary

This rule detects execution of the Kraken ransomware encryptor with its characteristic key, path, timeout and directory command-line switches. The binary encrypts victim files and appends the .zpsc extension while dropping a ransom note. Detecting the encryptor invocation provides a late-stage indicator of active ransomware deployment.

Suspicious Active Directory Enumeration via ADFind (via process_creation)

This rule detects execution of ADFind or a binary carrying ADFind's characteristic query switches used to enumerate domain accounts, computers and trusts. Emotet operators run ADFind during staging to map the Active Directory environment before lateral movement. Broad directory reconnaissance from an interactive host is rarely legitimate outside of sanctioned administration.

Malicious WSH Script Execution from WebDAV Share (via process_creation)

This rule detects wscript.exe or cscript.exe executing a script hosted on a remote WebDAV share as shown by the DavWWWRoot path token, a delivery method abused through malicious URL and LNK files pointing at Cloudflare tunnel WebDAV servers. Script execution directly from a WebDAV UNC path is rarely legitimate.

Malicious DLL Sideloading via LOLBins from ProgramData by Dohdoor

This rule detects trusted Windows utilities loading propsys or batmeter DLLs from ProgramData or the Public directory. The Dohdoor campaign sideloads its payload through living-off-the-land binaries such as OpenWith and mblctr running from unusual paths. A signed utility loading a system-named DLL from a writable directory is a strong sideloading indicator.

Suspicious Playit.gg Tunnel Domain Resolution Used by XenoRAT (via dns_query)

This rule detects DNS resolution of playit.gg tunnel subdomains under the gl.at.ply.gg pattern used as XenoRAT command-and-control endpoints distributed through .gg domains and GitHub. Adversaries leverage the free playit.gg tunneling service to expose their RAT controller while hiding the true C2 host.

Suspicious Browser History Clearing via RunDll32 InetCpl ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to wipe browsing history and cached traces, an indicator-removal behavior used by the CylindricalCanine GoldenEyeDog subgroup during the DigiCert-linked intrusion. Adversaries clear these tracks to hinder investigation after credential and screenshot collection, making detection useful for surfacing anti-forensic activity on a compromised host.

Suspicious ClickFix Command Staged in RunMRU Registry Key

This rule detects an mshta, PowerShell, or HTTP-bearing command written into the Explorer RunMRU registry key, the artifact left when a user pastes a ClickFix lure into the Windows Run dialog. RunMRU records commands executed through Run, exposing the social engineering payload. Interpreter or URL strings in RunMRU are a reliable indicator of ClickFix execution.

Masquerading Certificate Issuance with Certighost cdc and rmd Request Attributes (via security)

This rule detects certificate issuance events carrying the cdc or rmd request attributes used by the Certighost CVE-2026-54121 exploit to steer a Certificate Authority toward an attacker-chosen client Domain Controller. Adversaries leverage these attributes to obtain a certificate that authenticates as a Domain Controller machine account, making early detection critical for exposing certificate-based DC impersonation before DCSync.

Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)

This rule detects the GootBot implant using the PowerShell Start-Job cmdlet to run base64-decoded payloads in background jobs, evading child-process monitoring. The pairing of Start-Job with a FromBase64String call inside a scriptblock is a strong indicator of in-memory loader activity. Routine administrative scripts seldom combine these.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry (UAT-7237)

This rule detects setting the LocalAccountTokenFilterPolicy registry value to 1, which disables remote UAC filtering and grants full administrative tokens to local accounts over the network. The UAT-7237 group enables this to facilitate lateral movement with local administrator credentials. This change weakens a key remote-access security control.

Suspicious Registry Run Key Modification For Persistence

This rule detects new or modified values under the Windows Run and RunOnce autostart keys observed through registry set telemetry. In the WithSecure Code Execution and Persistence Lab 2 payload paths are written to these keys to launch at logon. Attackers use autostart registry persistence to maintain access across reboots.

Malicious Ransomware Ransom Note README-RECOVER File Creation

This rule detects creation of README-RECOVER ransom note text files, the note naming convention dropped during the Qilin ransomware encryption stage. These notes appear across directories once mass file encryption completes. Their creation is a definitive indicator that ransomware impact has already occurred and requires immediate response.

Malicious Spool Process Spawned a CMD Shell - PrintNightmare Vulnerability - CVE-2021-36958 (via process_creation)

This rule detects exploits the PrintNightmare vulnerability and obtained a CMD shell.

Malicious Outlook Process Memory Dump via procdump

This rule detects procdump creating a full memory dump of the Outlook process, a technique the ToddyCat APT used to extract email data and credentials from memory. The attackers ran procdump64.exe with -ma against OUTLOOK.exe to capture its address space for later mining. Dumping the memory of a mail client is a strong sign of credential and email data theft rather than routine troubleshooting.