Sigma detection rules, expert-reviewed

Suspicious SUID Bit Set on Binary from Container Context

This rule detects the setuid bit being applied to a binary via chmod, a privilege escalation step used after container escapes to leave a root-owned SUID backdoor on the host. Creating a SUID binary provides a durable path back to root. Detecting this exposes privilege escalation and persistence following a breakout.

Suspicious Docker Socket Access via curl Unix Socket for Container Escape

This rule detects curl talking to the Docker daemon over its Unix socket to create or start containers, a technique used to escape a container by spawning a privileged sibling with the host filesystem mounted. Direct access to docker.sock grants effective root on the node. Detecting this exposes an attempted breakout through the exposed Docker API.

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell wscript or cscript, the initial execution DarkGate triggers when a lure workbook launches an embedded object to pull remote scripts over SMB. Office applications launching script hosts is a strong indicator of malicious document activity. Detecting this parent-child relationship exposes the DarkGate delivery stage.

Suspicious AutoHotkey Script Execution from User Writable Path by DarkGate

This rule detects the AutoHotkey interpreter running an ahk script, the execution stage DarkGate reaches after reconstructing AutoHotKey.exe and launching script.ahk to carry out its malicious logic. AutoHotkey provides a scripting runtime that adversaries repurpose for command and control and payload handling. Detecting interpreter plus script execution exposes the DarkGate second stage.

Malicious certutil Decodehex Payload Reconstruction by DarkGate

This rule detects certutil being run with the decodehex option to reconstruct a binary from a downloaded hex-encoded file, a step DarkGate uses to rebuild an AutoHotkey interpreter from a dropped a.bin file. Abusing certutil for decoding is a living-off-the-land technique that evades signature-based download controls. Detecting this exposes payload deobfuscation during the DarkGate infection chain.

Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400

This rule detects the PAN-OS running configuration being copied or staged into a web-accessible file carrying a .css extension, a behavior observed in Operation MidnightEclipse exploiting CVE-2024-3400. Attackers rename running-config.xml to a stylesheet so the device configuration can be retrieved over the management web interface. Detecting this exposes hands-on-keyboard post-exploitation and configuration theft on the firewall.

Suspicious EACoreServer Masquerading as WindowsUpdate Executable (via process_creation)

This rule detects a process launched as WindowsUpdate.exe whose original file name is EACoreServer.exe, the renaming trick a Chinese APT used to disguise a legitimate signed binary as a Windows update component for sideloading. The mismatch between the on disk name and the embedded original name exposes the masquerade, distinguishing it from genuine update processes.

Suspicious StrelaStealer DLL Execution via Rundll32 Hello Export from Temp (via process_creation)

This rule detects rundll32.exe invoking the hello export of a DLL located in an AppData or temp directory, the loader behavior StrelaStealer uses to run its stealer payload dropped by a JScript file. The combination of a proxy execution binary, a user writable path, and the campaign specific export name reflects the StrelaStealer execution stage rather than normal library invocation.

Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)

This rule detects certutil being used with the decode and force flags to convert a Base64 encoded file into an executable payload, the deobfuscation step in the StrelaStealer infection chain. Because certutil decode is a living off the land technique for staging hidden binaries, this usage warrants review as likely payload unpacking.

Suspicious Csrss Process Masquerading Outside System32 (via process_creation)

This rule detects a process named csrss.exe running from any location other than the System32 or SysWOW64 directories, a masquerade used by the Glupteba packed installer to blend with the legitimate Client Server Runtime Subsystem. The genuine csrss.exe only ever launches from System32, so an off path copy indicates a spoofed loader attempting to hide malicious execution.

Malicious Mispadu Payload Execution from WebDAV Share via Rundll32 (via process_creation)

This rule detects rundll32.exe executing a DLL from a remote WebDAV share referenced through a file URL, a delivery technique used by the Mispadu infostealer to bypass SmartScreen and run its payload. Mispadu is a Latin American banking trojan that harvests browser credentials, and this remote execution path lets it evade reputation-based controls during initial access.

Malicious Scheduled rundll32 Execution of ProgramData VMware DLL by BianLian

This rule detects rundll32.exe executing a DLL from a ProgramData VMware directory with an Entry export and redirecting output to a temp file, matching the persistence and execution behavior of the BianLian ransomware group per Unit 42. The actor masquerades its loader as a VMware component and runs it via a scheduled task which evades scrutiny and maintains access.

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

This rule detects Task Manager being used to create a memory dump of the LSASS process, matching credential access observed after Ivanti appliance exploitation by Unit 42. Adversaries dump LSASS through the built-in Taskmgr interface to harvest credentials while avoiding known dumping tools which enables further lateral movement.

Suspicious File Download via bitsadmin Transfer by Medusa Ransomware

This rule detects use of bitsadmin with the transfer argument to download files through the Background Intelligent Transfer Service, matching tooling ingress used by Medusa ransomware operators per Unit 42. Adversaries abuse the trusted bitsadmin utility to fetch payloads while evading application controls which supports staging of ransomware components.

Suspicious Mimilite Credential Dumper Execution Writing KB-Named Output

This rule detects execution of the Mimilite update.exe credential dumper writing its output to a KB-named text file, matching the toolset used against organizations in the Middle East, Africa and the US per Unit 42. The actor masquerades a dumping utility as an update binary and stores harvested secrets in a fake KB patch file which supports credential access.