Sigma detection rules, expert-reviewed

Malicious PowerShell Download Rename and Execute Chain via Script Block

This rule detects a PowerShell script block that downloads a file into the public directory with Invoke-WebRequest, renames it to an executable with Rename-Item, and launches it with Start-Process. RomCom uses this exact chain after its Firefox and Windows zero-day exploitation to stage and run its backdoor. This indicates scripted payload delivery following exploitation.

Suspicious conhost Headless Execution for Hidden Window

This rule detects conhost launched with the --headless flag which suppresses the console window, a defense evasion technique seen in ACR Stealer intrusion chains. Hiding the console window conceals attacker command execution from the user during infostealer activity.

Suspicious NetSupport RAT client32 Execution

This rule detects execution of client32.exe, the NetSupport Manager remote control client. The Horns and Hooves campaign delivered NetSupport RAT as client32.exe for remote access, and its presence outside sanctioned NetSupport deployments should be investigated.

Malicious Active Directory Database (NTDS.dit) Extraction (via process_creation)

This rule detects extraction of the Active Directory database via ntdsutil Install-From-Media snapshots or shadow-copy access to ntds.dit, which yields every domain credential hash for offline cracking and forging. NTDS credential access is a high-impact technique in the Red Canary Threat Detection Report and a common precursor to domain-wide compromise. Detecting these extraction commands surfaces a domain-controller-level credential theft.

Malicious Domain Group Membership Change (via powershell)

This rule detects if a member is added to a domain group via PowerShell.

Suspicious Scheduled Task Persistence Referencing AppData Roaming

This rule detects schtasks.exe creating a task whose action points to an executable staged under the user AppData Roaming directory, the persistence pattern used by TrickBot after copying itself into that location. Malware favors AppData Roaming because it is user writable and survives across sessions. Scheduled tasks launching binaries from a roaming profile path are uncommon for legitimate software.

Suspicious Scheduled Task Executing VBScript via Process Creation

This rule detects creation of a scheduled task that runs VBScript through wscript or cscript, matching UAC-0099 persistence that fires a VBS loader every few minutes to relaunch a hidden PowerShell beacon. Adversaries chain the task scheduler with script hosts for resilient, low-profile persistence.

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning PowerShell or cmd.exe, behavior produced when the GhostRedirector group abuses the xp_cmdshell stored procedure to run operating system commands. A database engine launching a shell indicates SQL-based remote code execution used for downloading tooling and establishing footholds on Windows servers.

Malicious QEMU SSH Tunnel via Scheduled Task on Nonstandard Port (via process_creation)

This rule detects a scheduled task launching qemu-system-x86_64 to establish an SSH tunnel on nonstandard port 22022, a covert access technique observed after SolarWinds Web Help Desk exploitation. Observed in Elastic Security Labs telemetry where a TPMProfiler task runs QEMU to proxy traffic and evade network controls for persistent remote access.

Malicious Event Log Clearing via wevtutil by The Gentlemen RaaS (via process_creation)

This rule detects wevtutil clearing the Security, Application, or System event logs, an anti-forensic action performed by The Gentlemen ransomware operators to erase traces of intrusion. Wiping logs hampers incident response and hides prior activity. Detection of log clearing is a strong indicator of hands-on-keyboard compromise.

Suspicious Self-Deletion Batch Artifact by JadeProx TriBack Loader (via file_event)

This rule detects creation of the ~del.vbs.bat self-deletion artifact dropped by the JadeProx TriBack loader to remove its own components and cover its tracks. The distinctive double-extension cleanup file marks post-execution defense evasion. Detecting it exposes JadeProx anti-forensic activity.

Malicious Exchange Transport Agent Injection via Configuration File (via file_event)

This rule detects load an artifact in the Exchange transport agent.

Malicious Remote Process Creation via wmic node call create

This rule detects wmic invoking process call create against a remote node. The CloudComputating group used this WMI technique to execute commands on remote hosts for lateral movement across the network, which is uncommon in routine administration.

Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute

This rule detects creation of a scheduled task that repeatedly invokes rundll32 against the DllRegisterServer export on a per-minute trigger. OysterLoader uses this technique to persist a malicious DLL dropped into the user profile. A minute interval task launching rundll32 with DllRegisterServer is rarely legitimate and typically indicates loader persistence.

Malicious Service Abuse with Malicious ImagePath - Reg via PowerShell (via powershell)

This rule detects modify the original service executable path with a malicious one.