Sigma detection rules, expert-reviewed

Masquerading Computer Account Manipulation for Delegation - RBCD (via security)

This rule detects manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

This rule detects bitsadmin.exe configuring a background transfer job to launch a command when it completes, using SetNotifyCmdLine or a long-lived custom job, an abuse of the Background Intelligent Transfer Service for stealthy persistence and execution. BITS abuse appears in the Red Canary Threat Detection Report as a way to survive reboots and run payloads under a trusted service. Detecting notify-command job setup surfaces the persistence mechanism.

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

This rule detects whoami being run with its output redirected into a file, a reconnaissance-and-staging behavior used by loaders such as SocGholish to capture the current user and privilege context for the operator to review. Automated whoami-to-file collection is documented in the Red Canary Threat Detection Report as an early post-compromise step. Because interactive users rarely redirect whoami output to disk, this is a useful indicator of scripted hands-on activity.

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

In-Memory AMSI or ETW Bypass in PowerShell (via process_creation)

This rule detects PowerShell command lines containing AMSI or ETW bypass constructs (AmsiScanBuffer, amsiInitFailed, System.Management.Automation.AmsiUtils or EtwEventWrite patching), which blind script scanning and telemetry so malicious code runs undetected. AMSI and ETW tampering is a defense-evasion technique highlighted in the Red Canary Threat Detection Report. Detecting these strings surfaces an attacker disabling instrumentation before executing a payload.

Malicious Service Permissions Hijacked for Privileges Abuse - Service (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

This rule detects a program launching from a mounted ISO, IMG or VHD volume, the delivery pattern adversaries use to bypass Mark-of-the-Web so downloaded payloads run without SmartScreen or Office protections. Container-file delivery is a recurring initial-access and defense-evasion behavior in the Red Canary Threat Detection Report, favored by loaders arriving through phishing. Detecting execution from a freshly mounted image surfaces the smuggled payload before it detonates.

Malicious Service Abuse with Backdoored "command Failure" - Service (via process_creation)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

CMSTP Execution of an INF Profile (via process_creation)

This rule detects cmstp.exe processing an INF connection profile, including remote profiles, a signed-binary proxy technique used to run commands and bypass application allowlisting and UAC. CMSTP abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-installer abuse for code execution.

Malicious Account Set with Reversible Encryption - Weakness Introduction (via security)

This rule detects set an account with reversible encryption to facilitate brutforce or cracking operations.

Suspicious Disabled Guest or Builtin Account Activated (via security)

This rule detects enables a disabled builtin account.

PsExec Remote Service Execution on Target Host (via process_creation)

This rule detects the PSEXESVC service binary executing on a host, which indicates a remote PsExec-style command was pushed to this machine over SMB for lateral movement. PsExec remote execution is a lateral-movement technique frequently seen in the Red Canary Threat Detection Report. Detecting the service-side artifact surfaces remote command execution landing on the target.

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via Command (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

XSL Script Processing via WMIC or MSXSL (via process_creation)

This rule detects XSL script processing through wmic.exe /format with a remote or local .xsl stylesheet or through msxsl.exe, both of which execute embedded script and proxy code past application allowlisting. XSL script processing is a signed-binary-proxy-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary abuse used to run attacker-controlled script.

Obfuscated File Decoding via Certutil (via process_creation)

This rule detects certutil being used with its decode flags to convert a base64 or hex-encoded file back into an executable payload, a deobfuscation step adversaries use to reconstruct malware from a benign-looking encoded file. Certutil deobfuscation is a defense-evasion technique in the Red Canary Threat Detection Report because it hides payloads from content inspection in transit. Detecting decode invocations surfaces payload staging under a trusted binary.