Sigma detection rules, expert-reviewed

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

This rule detects blacklotus HTTP downloader injection into winlogon.exe process.

Malicious Event Log Clear Attempt - Wmi (via process_creation)

This rule detects clear the event logs.

Suspicious File Permission Grant to Everyone via Icacls (via process_creation)

This rule detects icacls granting the Everyone principal full control of files or directories, a file-permission-modification step attackers use to make payloads world-writable or to weaken protected paths. Broad permission grants are tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces tampering with access controls.

Malicious Interactive Privileged Shell Triggered by Schedule Task - Deprecated (via process_creation)

This rule detects abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

This rule detects enumerate potential existing users, resulting in failed logins with unexisting or invalid accounts.

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Any Protocol (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Webserver IIS Configuration Edited - SYSMON (via file_event)

This rule detects edit IIS configuration file in order to load a module.

USN Change Journal Deletion via Fsutil (via process_creation)

This rule detects fsutil deleting the NTFS USN change journal, an indicator-removal technique that erases the record of file creations and modifications to frustrate forensic timeline reconstruction. USN journal deletion is tracked in the Red Canary Threat Detection Report. Detecting this command surfaces anti-forensic activity on the host.

Obfuscated Massive Service Failures - Tchopper (via system)

This rule detects uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

This rule detects wuauclt.exe invoked with UpdateDeploymentProvider and RunHandlerComServer arguments, which loads an attacker DLL through the Windows Update client, a signed-binary proxy technique. Wuauclt abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces trusted-binary DLL loading.

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

This rule detects PowerShell setting both CreationTime and LastWriteTime on a file, the hallmark of timestomping used to blend a dropped payload in with legitimate files and defeat timeline analysis. Timestomping is an indicator-removal technique tracked in the Red Canary Threat Detection Report. Detecting these property assignments surfaces anti-forensic tampering with file metadata.

Malicious DLL ServerLevelPluginDll Registration - Reg via Sysmon (via registry_set)

This rule detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.

Registry Query for WDigest

Rule to detect discovery activity for WDigest registry settings

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

This rule detects reg.exe saving the SAM, SYSTEM or SECURITY registry hive to disk, which lets an attacker extract local credential material and boot keys for offline hash recovery. Registry hive dumping is a credential-access technique documented in the Red Canary Threat Detection Report. Detecting these save commands surfaces local credential theft in progress.

Suspicious Code Execution via InstallUtil LOLBIN (via process_creation)

This rule detects InstallUtil.exe run with uninstall or log-suppression flags used to trigger attacker code in a .NET assembly's Uninstall method while avoiding console output, a signed-binary proxy technique. InstallUtil abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these command lines surfaces code execution under a trusted Microsoft utility.