Sigma detection rules, expert-reviewed

Malicious UAC Bypass via sdclt Handler Hijack (via registry_set)

This rule detects modification of the HKCU exefile runas isolatedCommand or Folder shell open command keys that sdclt.exe consults, a registry hijack used to auto-elevate an attacker command without a UAC prompt. This sdclt handler hijack is a privilege-escalation technique tracked in the Red Canary Threat Detection Report. Detecting the key change surfaces a UAC-bypass being staged.

Malicious Winlogon Shell or Userinit Persistence Modification (via registry_set)

This rule detects modification of the Winlogon Shell or Userinit values, which are executed at every interactive logon and are abused to launch a payload persistently with the user's session. Winlogon helper persistence is a technique tracked in the Red Canary Threat Detection Report. Detecting changes to these keys surfaces a logon-triggered persistence foothold.

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

This rule detects rclone being run with copy, sync or move operations to a cloud remote, the staging-and-exfiltration tool ransomware crews use to bulk-transfer stolen data before encryption. Data exfiltration over cloud storage is documented in the Red Canary Threat Detection Report as a hallmark of double-extortion intrusions. Detecting rclone transfer commands surfaces exfiltration during the critical window before impact.

Malicious Diskshadow Command Abuse to Expose VSS Backup (via process_creation)

This rule detects attemps to create an IFM for dumping credentials.

Suspicious RDP Shadow Session Started - Native (via rdp)

This rule detects has initiated a RDP shadow session.

Malicious Tampering With Windows Defender Protection (via process_creation)

This rule detects command-line attempts to disable core Microsoft Defender protections, such as turning off real-time monitoring through Set-MpPreference or adding broad exclusions, or stopping and disabling the WinDefend service. Impairing endpoint defenses is a common defense-evasion step in the Red Canary Threat Detection Report, clearing the way for follow-on tooling to run undetected. Detecting these tamper commands surfaces the adversary weakening the host before further action.

Suspicious LSASS Credential Dump with LSASSY - PowerShell (via powershell)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious Medium Risk Local/domain Local Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed.

Suspicious Brutforce with Denied Access Due to Account Restrictions Policies (via security)

This rule detects attemps to use a comprimised account but failed to login due to account restrictions policies (permissions, time restrictions, workstation, logon type, ...).

Suspicious Scheduled Task Creation with Command Line (via process_creation)

This rule detects creates a scheduled task via commmand line.

Malicious Massive Processes Termination Burst (via process_creation)

This rule detects kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Suspicious Permissions Modification on a Network Share (via security)

This rule detects modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares.

GateDoor DLL Search Order Hijacking via WebView2Loader from MicrosoftEdging (via image_load)

This rule detects WebViewHost.exe loading a WebView2Loader.dll from the roaming MicrosoftEdging directory, the DLL search-order hijack GateDoor uses to run malicious code under a WebView2 host name. Because the legitimate loader ships inside vendor install paths, a WebView2Loader.dll executing from the user roaming profile is a reliable side-loading indicator.

Malicious Firewall Deactivation - PowerShell (via powershell)

This rule detects disabled the Windows Firewall to evade defense.

Masquerading Administrator Login Impersonation with Forged Golden Ticket (via security)

This rule detects used a forged Golden ticket to login on a remote host. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.