Sigma detection rules, expert-reviewed

Suspicious Malicious IIS Module DLL Written to Inetsrv Directory (via file_event)

This rule detects the creation of a caches.dll file within the System32 inetsrv directory as used by the Larva-25003 IIS malware to host its native module. Dropping a new DLL into the inetsrv module directory is an unusual event outside of IIS feature installation.

EAP Service Activation by Liontail Framework for DLL Sideloading - Via Command (via process_creation)

This rule detects enable the Eaphost component in order to perform a DLL sideloading attack.

Suspicious Commonly-Hijacked DLL Loaded From a User-Writable Path (via image_load)

This rule detects a process loading a frequently search-order-hijacked system DLL name from a user-writable directory such as AppData, Temp or ProgramData, indicating DLL search-order hijacking where an attacker-planted DLL is loaded instead of the legitimate one. DLL hijacking is a persistent defense-evasion and persistence technique in the Red Canary Threat Detection Report. Detecting these known-abused DLL names loading from non-system paths surfaces the hijack.

Malicious User Password Change Using Current Hash Password - ChangeNTLM - Mimikatz (via security)

This rule detects resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Suspicious Account Password Set to Never Expire. (via security)

This rule detects scenarios where an account password is set to never expire.

Malicious Modification of a Computer Account SPN (via security)

This rule detects update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.

Suspicious Massive Group Membership Changes (via security)

This rule detects will add a compromised account into different domain groups in order to gain access to all the assets under the control of those concerned groups.

Malicious High Risk Active Directory Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed.

Malicious Account Marked as Sensitive and Cannot Be Delegated Had Its Protection Removed (via security)

This rule detects removes security protection from a sensitive account to escalate privileges.

Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)

This rule detects execution of the SharpHound collector or the Invoke-BloodHound cmdlet using its characteristic collection-method arguments, which harvest Active Directory objects, sessions and access-control relationships to map attack paths to Domain Admin. Large-scale AD discovery like this is a common pre-lateral-movement step seen across intrusions in the Red Canary Threat Detection Report. Detecting the collector's invocation surfaces reconnaissance before the adversary pivots.

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Kerberos Only (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Host Set with Unconstrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Host Set with Constrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Masquerading Computer Account Manipulation for Delegation - RBCD (via security)

This rule detects manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

This rule detects bitsadmin.exe configuring a background transfer job to launch a command when it completes, using SetNotifyCmdLine or a long-lived custom job, an abuse of the Background Intelligent Transfer Service for stealthy persistence and execution. BITS abuse appears in the Red Canary Threat Detection Report as a way to survive reboots and run payloads under a trusted service. Detecting notify-command job setup surfaces the persistence mechanism.