Sigma detection rules, expert-reviewed

Suspicious Silent Installation of Remote Management Software (via process_creation)

This rule detects silent or unattended command-line installation of remote monitoring and management tools such as AnyDesk, ScreenConnect, Atera or ConnectWise, which adversaries deploy for stealthy remote access that blends into legitimate IT tooling. Abuse of RMM software for remote access is a technique repeatedly profiled in the Red Canary Threat Detection Report. Detecting unattended installs surfaces attacker-controlled remote access being established.

DSRM Password Changed - Native (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

PowerShell Storing an Encoded Payload in the Registry (via process_creation)

This rule detects PowerShell writing a base64 or byte-array value into an HKCU registry key, the fileless persistence and staging behavior seen in Solarmarker and Yellow Cockatoo intrusions. Storing an encoded payload in the registry is a defense-evasion and persistence technique tracked in the Red Canary Threat Detection Report. Detecting this write surfaces a fileless payload being cached for later execution.

Malicious DCSync Domain Replication Credential Theft (via process_creation)

This rule detects command lines invoking DCSync-style directory replication (lsadump::dcsync or a /dcsync switch), which abuses replication rights to pull password hashes for any account directly from a domain controller. DCSync is a high-impact credential-access technique in the Red Canary Threat Detection Report and a route to domain dominance. Detecting the replication request surfaces theft of privileged credentials without touching LSASS.

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

This rule detects command lines that enumerate installed antivirus or EDR products through the SecurityCenter2 WMI namespace or Get-MpComputerStatus, a security-software-discovery step taken to plan defense evasion. Security software discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces an attacker profiling defenses before acting.

Malicious DLL ServerLevelPluginDll Command Installation (via process_creation)

This rule detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.

Malicious Scheduled Persistent Task with SYSTEM Privileges Creation (via process_creation)

This rule detects creates a privileged task to establish persistence.

VSS Backup Deletion or Resize (via process_creation)

This rule detects delete or resize existing VSS backup.

Malicious Wdigest Authentication Enabled - Reg via Command (via process_creation)

This rule detects enable Wdgiest authention so passwords are stored in clear text and can be dumped.

Malicious Boot Recovery Tampering via Bcdedit (via process_creation)

This rule detects bcdedit disabling automatic recovery or forcing the boot status policy to ignore failures, an inhibit-system-recovery step ransomware runs so victims cannot restore Windows after encryption. Boot-configuration tampering is an impact technique tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces recovery being sabotaged ahead of encryption.

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

This rule detects attempt to dump the LSASS process via the Task Manager.

Malicious Compiled HTML Help Process Spawning a Script Interpreter (via process_creation)

This rule detects the Windows help viewer hh.exe spawning a command shell or script interpreter, which happens when a weaponized compiled HTML help (.chm) file executes embedded script for proxy execution. Compiled HTML File abuse is a System Binary Proxy Execution technique in the Red Canary Threat Detection Report used to run code under a trusted binary and evade allowlisting. Detecting interpreter children of hh.exe surfaces malicious CHM execution.

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

This rule detects command-line archive tools (rar, 7z, WinRAR) creating password-protected or split archives, a collection-and-staging step attackers use to bundle stolen data before exfiltration. Archiving collected data is a technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces data being packaged for theft.

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

This rule detects blacklotus HTTP downloader injection into winlogon.exe process.

Malicious Event Log Clear Attempt - Wmi (via process_creation)

This rule detects clear the event logs.