Sigma detection rules, expert-reviewed

Suspicious Chisel SOCKS Tunnel Command Line

This rule detects command lines invoking the Chisel tunneling tool in client mode with SOCKS proxying. In the Africa financial-sector intrusions Chisel established SOCKS tunnels for covert remote access and lateral movement. This command-line pattern reveals tunneling regardless of the binary name.

Suspicious Scheduled Task Masquerading as Palo Alto Cortex Services

This rule detects creation of a scheduled task named to impersonate Palo Alto Cortex security services. Threat actors targeting African financial institutions used this task name to disguise persistence for their tooling. A security-vendor-themed task name created through schtasks is a masquerading persistence indicator.

Suspicious Cloud Instance Metadata Token Retrieval via Command-Line Tool

This rule detects command-line tools such as curl or PowerShell requesting an access token from a cloud instance metadata endpoint. Attackers query metadata.google.internal, the 169.254.169.254 link-local address, or the Azure managed-identity endpoint to steal short-lived workload tokens after gaining code execution. Harvesting these tokens lets adversaries impersonate cloud service identities.

Suspicious File Download via Certutil URLCache

This rule detects the certutil utility used with urlcache to download a remote file over HTTP, a living-off-the-land technique seen after CVE-2025-31324 exploitation of SAP NetWeaver. Attackers use certutil to retrieve second-stage payloads while evading application controls. This LOLBIN download behavior is rarely legitimate on servers.

Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog

This rule detects PowerShell spawned from the Windows Run dialog that combines Invoke-WebRequest with Start-Process to download and launch a payload. This pattern is used by the Lampion banking malware ClickFix campaign that tricks users into pasting a malicious one-liner. Attackers abuse this social-engineering vector to gain initial code execution while blending into normal user activity.

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

This rule detects command-line access to wallet.dat files, targeted by Gremlin Stealer to harvest cryptocurrency wallet data alongside browser cookies and credentials. Collecting wallet.dat is a common stealer behavior aimed at draining victim crypto assets after exfiltration.

Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)

This rule detects creation of a scheduled task named w32analytics that executes rundll32 against w32analytics.dll, a persistence mechanism observed in recent unusual malware analyzed by Unit 42. Combining scheduled task persistence with rundll32 proxy execution lets the loader run its DLL export on a recurring basis while evading direct binary controls.

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

This rule detects the renamed Windows debugger cdb.exe masquerading as fontdrvhost.exe in C:\ProgramData and loading shellcode from config.ini, a loader used by the Squidoor backdoor. Running the signed cdb LOLBin under a spoofed name from a non-standard path proxies malicious code execution past application controls.

Suspicious MSBuild Inline Task Compilation of mini.xml

This rule detects MSBuild executing the project file mini.xml to compile and run inline code. This behavior matches post-exploitation of Ivanti CVE-2025-0282 where a msbuild.lnk shortcut invoked MSBuild as a trusted developer utility to execute attacker code. MSBuild compiling arbitrary XML project files is a proxy execution technique used to bypass application controls.

Suspicious AdFind Domain User Reconnaissance Output

This rule detects command lines writing to the reconnaissance output file Domain_users_light.txt associated with AdFind based Active Directory enumeration. This behavior matches intrusions that rename AdFind to a.logs and dump domain user objects for targeting. Structured directory enumeration output is a discovery indicator that commonly precedes lateral movement and Kerberoasting.

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Suspicious Hidden Encoded PowerShell Execution

This rule detects PowerShell launched with a hidden window, bypassed execution policy, and a base64-encoded command. This behavior matches the BlackSuit intrusion chain where operators run obfuscated encoded payloads to stage tooling while evading logging. The combination of hidden execution and encoding is a common obfuscation pattern used to conceal malicious in-memory activity.

Malicious NTDS Database Dump via ntdsutil

This rule detects use of ntdsutil to create a full copy of the Active Directory NTDS.dit database. This behavior matches BlackSuit ransomware operators who dump the domain credential store for offline extraction of password hashes. Access to NTDS.dit enables domain-wide credential compromise and is a high-severity precursor to lateral movement and full domain takeover.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of all volume shadow copies via vssadmin with the quiet flag. This behavior matches BlackSuit ransomware operated by Ignoble Scorpius which removes shadow copies to inhibit system recovery before encryption. Shadow copy deletion is a strong pre-encryption indicator and warrants immediate response to prevent irreversible data loss.

Malicious FrostyGoop OT Encryptor Execution with Modbus Config

This rule detects execution of the FrostyGoop OT malware binary go-encrypt.exe or any process referencing its task_test.json Modbus configuration file. This behavior matches the FrostyGoop campaign targeting industrial control systems where the tool read a JSON target list to issue unauthorized Modbus commands. Detecting the encryptor and its config is critical because it directly manipulates OT device registers and can disrupt physical processes.