Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Creation Named test3 by Salt Typhoon

This rule detects creation of a scheduled task named test3 via schtasks, a persistence artifact observed in Salt Typhoon intrusions. The generic task name is used to blend malicious persistence into normal task activity.

Suspicious Symbolic Link Evaluation Enabled via fsutil by RansomHub Ransomware

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation, a configuration change RansomHub uses to reach and encrypt files across redirected paths. Enabling these symlink behaviors is uncommon in normal administration.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

This rule detects the IIS worker process w3wp.exe spawning cmd.exe to run nslookup, matching the out-of-band verification step in the WS_FTP Ad Hoc deserialization exploit for CVE-2023-40044 shown by Assetnote. A web worker executing shell commands that resolve attacker-controlled hostnames indicates code execution through the vulnerable HTTP module. Such a process chain from IIS is rarely legitimate and points to active exploitation.

Possible JSP Webshell Dropped in Tomcat Webroot by DotCMS Exploit CVE-2022-26352

This rule detects creation of a JSP file inside the DotCMS Tomcat webroot dojo static directory. Exploitation of CVE-2022-26352 writes a JSP webshell such as ROOT/html/js/dojo/a.jsp via path traversal as shown by Assetnote, so a JSP appearing in this static asset path indicates a planted webshell.

Suspicious PlugX Persistence via CanonPrinter Run Key (via registry_set)

This rule detects creation of a CurrentVersion Run registry value named CanonPrinter that points to a sideloading executable in a user AppData Roaming directory. UNC6384 used this Run key to persist the Canon binary that sideloads PlugX across reboots.

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

This rule detects a PowerShell one-liner enumerating all event logs and clearing them through the EventLogSession GlobalSession ClearLog method. Qilin ransomware operators used this to wipe forensic evidence across every log on compromised hosts.

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

This rule detects execution of a binary named FortiEndpoint_Patch.exe, the EKZ infostealer masqueraded as a Fortinet endpoint patch. It was delivered after FortiClient EMS exploitation to harvest browser credentials and cookies.

Suspicious BeyondTrust Bomgar Process Spawning Remote Access Client (via process_creation)

This rule detects a BeyondTrust Bomgar process spawning a renamed SimpleHelp remote access binary. Operators abused the CVE-2026-1731 command-execution flaw to deploy SimpleHelp under the SYSTEM account as a secondary remote access foothold.

Malicious NTDS Extraction via ntdsutil IFM (via process_creation)

This rule detects use of ntdsutil to create an Install From Media copy of the Active Directory database. Qilin ransomware operators ran ntdsutil with the ifm create full arguments to extract the NTDS database and registry hives for offline credential harvesting.

Suspicious MeshAgent Persistence via Scheduled Task MeshUserTask (via process_creation)

This rule detects creation of a scheduled task named MeshUserTask used to persist the MeshCentral MeshAgent remote management binary. Intrusion operators in the Anubis and Qilin ransomware campaigns installed MeshAgent for covert remote access and registered this task to survive reboots.

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

This rule detects execution of the cloudflared client establishing an outbound Cloudflare Tunnel. Operators behind the Anubis ransomware campaign dropped cloudflared to Windows and NAS hosts and ran it with tunnel and token arguments to create a persistent encrypted command and control channel that bypasses inbound firewall controls.

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

This rule detects the Windows tar utility extracting archive files with an unusual .ta extension. UNC6384 delivered PlugX by extracting rjnlzlkfe.ta and krnqdyvmlb.ta archives with tar into the Temp directory before executing the sideloaded Canon binary.

Suspicious Microsoft Defender Path Exclusion of User Directories (via process_creation)

This rule detects Add-MpPreference adding a Microsoft Defender exclusion path for the AppData Roaming, AppData Local or ProgramData directories. GPUGate and similar malware families exclude these user-writable staging locations before dropping payloads.

Suspicious RustDesk Remote Access Service Installation via sc (via process_creation)

This rule detects creation of a Windows service that launches RustDesk with an imported configuration. Akira ransomware operators installed RustDesk as an auto-start service using sc create to maintain unattended remote access to compromised hosts.