Sigma detection rules, expert-reviewed

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

This rule detects wmic being spawned by an anomalous parent such as an Office application, browser or scripting host. Legitimate WMIC use rarely originates from these processes, so this parent-child relationship points to WMI being abused for execution or discovery following initial access.

Possible Process Injection into Attrib via Mispadu AutoIt Loader (via process_creation)

This rule detects attrib.exe being spawned by the AutoIt3 interpreter, which corresponds to the Mispadu loader injecting its payload into an attrib.exe process. A legitimate AutoIt application launching attrib in this way is not expected.

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

This rule detects the Samsung MagicINFO application spawning cmd.exe to run reconnaissance commands such as whoami or arp, observed by Huntress following exploitation of the MagicINFO 9 server flaw. Attackers run host and network discovery immediately after gaining code execution through the vulnerable web application. Reconnaissance shells parented by the MagicINFO service indicate active post-exploitation.

Suspicious Deadglyph Rundll32 DLL Execution by Ordinal via process_creation

This rule detects rundll32.exe executing the pbrtl.dll loader by ordinal

Suspicious lmadmin License Manager DLL Sideload from Public Path via image_load

This rule detects the Schneider Electric license manager lmadmin.exe loading a DLL from the world-writable Users Public directory, the exploitation path for CVE-2024-2658. The service is coerced into loading an attacker-planted library from a writable location. This DLL hijack grants code execution in the context of the license service.

Malicious LSASS Memory Dump via dllhost with comsvcs MiniDump Arguments (via process_creation)

This rule detects dllhost.exe dumping LSASS memory using comsvcs-style MiniDump arguments, the credential-theft step observed in the intrusion where a CLFS zero-day was exploited before ransomware deployment. Adversaries dump LSASS to c:\programdata to harvest credentials for lateral movement ahead of encryption, so dllhost invoking a MiniDump against lsass is a high-confidence credential-access indicator.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevated Binary (via process_creation)

This rule detects the auto-elevating binary ComputerDefaults.exe being launched by a parent other than the normal interactive shells, the User Account Control bypass the STRT cross-RAT analysis attributes to Castle RAT via a hijacked ms-settings handler. Adversaries leverage this trusted binary to elevate a malicious command without a UAC prompt, making non-interactive launches a useful indicator for review.

Suspicious Certutil Encode or Decode for Payload Obfuscation (via process_creation)

This rule detects certutil being used with the -encode or -decode options to transform files between binary and Base64 form. Threat actors exploiting Citrix NetScaler CVE-2023-4966 used certutil to stage and deobfuscate tooling while evading content inspection. This living-off-the-land use of certutil for data encoding is a common defense-evasion and deobfuscation behavior.

Suspicious Novaservice Binary Executing From Public User Directory (via process_creation)

This rule detects execution of novaservice.exe from within the public user profile Documents or Downloads directories, a masquerade used by Boggy Serpens to run implant components from a world-writable location. A service-like binary executing from a user data path rather than a protected system directory indicates a planted payload.

Malicious DarkGate hVNC Credential Stash via cmdkey

This rule detects DarkGate storing hardcoded hidden-VNC credentials with cmdkey using the SafeMode user and the darkgatepassword0 secret. This exact credential string is unique to DarkGate hVNC sessions and reliably identifies the loader establishing covert remote access.

Malicious NTDS Extraction via NetExec (via process_creation)

This rule detects the NetExec nxc binary invoking its NTDS module over SMB to extract the Active Directory database. This was used to steal domain credential hashes en masse before ransomware deployment. Bulk NTDS extraction provides every domain account hash and enables full domain takeover.

Suspicious msxsl Execution with Text Script Dropper

This rule detects the msxsl utility being used to process a txt file as a script transformation. More_eggs operators abused msxsl with txt hosted JScript droppers to execute code outside normal script interpreters. This LOLBIN abuse bypasses application controls that only watch common scripting hosts.

Suspicious C2Looper Shell Output Artifact File Creation (via file_event)

This rule detects creation of the c2_out.txt file that the first version of C2Looper uses to capture the output of shell commands before exfiltrating it. This hardcoded output filename is characteristic of the backdoor.

Suspicious VBScript Launcher Execution via Wscript for Mining Operation (via process_creation)

This rule detects wscript executing the sysdata.vbs launcher used by the Monero mining operation to stage its payload and injection routine. Observed in the Elastic Security Labs fake-installer campaign where sysdata.vbs kicks off process injection into conhost or explorer to run the XMRig miner covertly.

Suspicious Plink SSH Tunnel Used for Data Exfiltration

This rule detects the PuTTY plink client invoked with port forwarding and non-interactive SSH options consistent with tunneling and exfiltration. Microsoft observed Marbled Dust using plink to exfiltrate collected data over SSH from Output Messenger victims. Command-line SSH tunneling by an espionage actor over an encrypted channel is used to bypass egress monitoring, so this pattern warrants investigation.