Sigma detection rules, expert-reviewed

Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)

This rule detects object access audit events for the DPAPI MachineKeys and the System (S-1-5-18) Protect directories by processes other than core system services, matching the file access seen while recovering active ADFS signing keys via machine DPAPI. Adversaries read these locations to obtain machine masterkeys and protected private keys, so unexpected access here indicates credential theft from key stores.

Suspicious PowerShell Console Window Hiding via ShowWindow

This rule detects PowerShell resolving GetConsoleWindow and calling ShowWindow to hide its own console, a stealth technique in the fake AI-tool installer chain that also re-executes itself for UAC. Hiding the window keeps the malicious script invisible to the user while it stages ransomware components in the background.

APT28 NotDoor Outlook Macro Security Bypass (via registry_set)

This rule detects Outlook security policy changes that lower the macro security Level to one and enable LoadMacroProviderOnBoot, the registry tampering APT28 performs to auto-load its NotDoor VBA backdoor at Outlook startup. Adversaries leverage these values to run malicious macros without prompts, making detection of either change important for catching mail-client persistence.

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

This rule detects PowerShell clearing Windows event logs by enumerating logs with Get-WinEvent and invoking ClearLog. The Qilin group wipes logs to destroy forensic evidence around encryption. Programmatic clearing of event logs is a hallmark anti-forensic action.

Suspicious Reflective Assembly Load in PowerShell (via ps_script)

This rule detects PowerShell script content that reflectively loads a .NET assembly directly from a base64-decoded byte array. This in-memory loading technique was observed in the SHADOW#REACTOR campaign to execute a .NET Reactor protected loader.

Suspicious PowerShell Invoking Remote HTA via Environment Variable Masquerading (via process_creation)

This rule detects PowerShell command lines that reference an environment-variable path together with a remote HTA URL. The CMSTP LNK loader uses this masquerading technique to launch mshta against attacker infrastructure.

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

This rule detects regsvr32.exe launched with the silent registration flags together with a remote scrobj.dll scriptlet reference, the classic Squiblydoo application whitelisting bypass. It is associated with campaigns that deliver regsvr32 execution through malicious Office documents as reported by Uptycs. Attackers use this to run remote COM scriptlets and proxy code execution past application controls, making it a high-value detection.

Possible n8n Campaign Datto RMM Relay Contact via centrastage.net

This rule detects DNS resolution of centrastage.net infrastructure associated with Datto RMM, which the n8n webhook campaign abuses as a remote management relay to control victim hosts. Because the domain also serves legitimate Datto RMM deployments, contact from an environment that does not sanction Datto is the meaningful signal. Correlate with unexpected RMM installers to confirm abuse.

Malicious JSP Webshell Written to SAP NetWeaver Servlet Directory

This rule detects creation of JSP webshell files with names observed in exploitation of the SAP NetWeaver CVE-2025-31324 file upload vulnerability inside servlet_jsp working directories. Adversaries drop these webshells to gain persistent remote command execution on the compromised application server. Detecting the file write surfaces web shell installation immediately after exploitation.

Malicious Web Shell Child Process Spawned by SAP Java Process (via process_creation)

This rule detects a SAP NetWeaver Java process spawning a command interpreter or reconnaissance utility such as cmd, PowerShell or whoami. Exploitation of CVE-2025-31324 drops a JSP web shell that executes commands through the Java runtime, so an interpreter child under the SAP Java process indicates post-exploitation web shell activity.

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

This rule detects creation of an alternate data stream named wtfbbq, an NTFS ADS MuddyWater uses to hide payload content from ordinary file listings. Storing data in a named stream conceals it from users and many tools. Detecting this distinctive stream name exposes ADS-based defense evasion.

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

This rule detects reg.exe writing Winlogon automatic-logon values by setting DefaultPassword together with AutoAdminLogon, a persistence and privilege-retention technique used in the Nitrogen BlackCat intrusion to plant a hardcoded backup domain account for reboot survival. Adversaries abuse AutoAdminLogon to store cleartext credentials and regain an interactive SYSTEM-adjacent session after the safeboot reboot, making it critical to surface before encryption.

Suspicious PythonLauncher Scheduled Task Creation via PowerShell Script

This rule detects PowerShell creating a scheduled task named with the PythonLauncher prefix, the logon persistence UAT-11795 registers for its Starland RAT as reported by Cisco Talos. The operators combine New-ScheduledTask with a PythonLauncher task name to relaunch the implant elevated at each logon. Matching this naming and API pattern reveals attacker persistence distinct from routine task creation.

Malicious Cloudflared Tunnel Established with Token

This rule detects cloudflared.exe running a tunnel with a token argument, a covert channel Huntress observed being launched through RMM tooling such as AgentPackageRunCommandInteractive to reach compromised MSP endpoints. Attackers use Cloudflare tunnels to proxy remote access past perimeter controls without inbound firewall changes. Token-based tunnel creation by cloudflared is a strong command-and-control indicator.

Suspicious curl Download to AppData Temp Directory (via process_creation)

This rule detects curl downloading remote content directly into the AppData Local Temp directory, the ingress technique DarkGate uses to stage its AutoIt loader and encrypted payload. Fetching executables into user Temp via curl is uncommon for legitimate software. Combined with an HTTP source this suggests malware staging.