Sigma detection rules, expert-reviewed

Malicious Outlook Process Memory Dump via procdump

This rule detects procdump creating a full memory dump of the Outlook process, a technique the ToddyCat APT used to extract email data and credentials from memory. The attackers ran procdump64.exe with -ma against OUTLOOK.exe to capture its address space for later mining. Dumping the memory of a mail client is a strong sign of credential and email data theft rather than routine troubleshooting.

Malicious WebDAV Payload Execution via rundll32 davclnt.dll (via process_creation)

This rule detects rundll32.exe invoking DavSetCookie from davclnt.dll, a WebDAV execution technique used by the TimbreStealer campaign to run remote payloads. Executing through the WebDAV client library retrieves and launches code from a remote share under a signed binary.

Suspicious CrazyHunter Distribution Tool Connecting to File Server on Port 9999

This rule detects the CrazyHunter distribution binary file.exe establishing a network connection to a staging file server on TCP port 9999. During the intrusion the operators host payloads on an internal file server and pull them via this tool over the uncommon port 9999, so this traffic indicates lateral staging of ransomware components before encryption.

Suspicious PowerShell Download Cradle Using irm and iex via Interlock Loader (via process_creation)

This rule detects the MintLoader stage of Interlock intrusions which runs PowerShell with a hidden window and pipes an Invoke-RestMethod download directly into Invoke-Expression. This irm to iex pattern fetches and executes remote code in memory. It is a common but high signal initial access technique for this actor.

Malicious WDigest UseLogonCredential Enablement For Credential Theft

This rule detects the registry modification that sets WDigest UseLogonCredential to 1, forcing Windows to keep cleartext credentials in LSASS memory. The Qilin ransomware group enables this before dumping credentials to escalate and move laterally. Re-enabling plaintext credential caching is a deliberate precursor to LSASS harvesting.

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

This rule detects a binary named mysql.exe running from a temporary directory with a hardcoded password argument, matching the HarborWatch RAT payload which is renamed to mysql.exe and requires a fixed pass value to execute. Genuine MySQL clients do not run from user temp folders.

Suspicious Domain Controller Discovery via nltest

This rule detects use of nltest to enumerate domain controllers and domain trust relationships, a reconnaissance step observed during CitrixBleed (CVE-2023-4966) post-exploitation. Attackers run this after gaining a foothold to map the Active Directory environment before lateral movement. Detecting the enumeration provides an early signal of hands-on-keyboard activity.

Malicious Octo Tempest Federation Persistence via AADInternals (via ps_script)

This rule detects use of the AADInternals PowerShell toolkit through its characteristic cmdlets. Octo Tempest leveraged AADInternals to forge Golden SAML tokens and manipulate Entra ID federation trust for persistent tenant access.

Malicious Matanbuchus Persistence via regsvr32 Silent Install with User Context (via process_creation)

This rule detects execution of regsvr32 with the no-register and user-context install flags to invoke a DLL entry point, the persistence and execution behavior run every five minutes by the Matanbuchus 3.0 EventLogBackupTask scheduled task. Adversaries leverage regsvr32 as a signed LOLBin to load a malicious DLL through its DllInstall path while bypassing DllRegisterServer monitoring, making early detection critical for surfacing loader persistence before payload deployment.

Suspicious Offensive Recon and Credential Tools Execution (via process_creation)

This rule detects execution of the fscan network scanner and the SharpDecryptPwd credential extraction utility. The SLOW#TEMPEST campaign used these tools for internal reconnaissance and browser credential theft.

Suspicious RegAsm Launched by Script Host (via process_creation)

This rule detects the .NET RegAsm utility being launched by a script host or Equation Editor. This steganography campaign injects Remcos, AgentTesla, and LimeRAT into RegAsm through process hollowing.

Suspicious Curl Download to Windows Temp via PowerShell (via process_creation)

This rule detects PowerShell invoking curl with follow-redirect to download a payload into the Windows Temp directory, a staging step in the SILENTCONNECT campaign delivering ScreenConnect. Observed in Elastic Security Labs telemetry where an execution-policy-bypassed PowerShell retrieves the next-stage installer for remote access.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Malicious System Recovery Inhibition via bcdedit Boot Configuration Changes (via process_creation)

This rule detects bcdedit disabling Windows recovery by setting recoveryenabled to No or bootstatuspolicy to ignoreallfailures, a recovery-inhibition behavior used by the Hunters International ransomware group per Group-IB. Adversaries alter the boot configuration to block automatic repair before encryption, making this a reliable pre-impact signal.

BURNBOOK DLL Sideloading via SumatraPDF.exe Loading libmupdf.dll from User Directory (via image_load)

This rule detects SumatraPDF.exe loading a libmupdf.dll from a user-writable directory such as Downloads or Temp, the DLL side-loading behavior used to launch the BURNBOOK loader delivered in a ZIP archive during Operation DreamJob intrusions. Adversaries pair a benign PDF reader with a malicious library to execute their loader under a trusted process.