Sigma detection rules, expert-reviewed

Suspicious search-ms URI Handler Invocation in CVE-2023-36584 Exploit Chain

This rule detects invocation of the search-ms Windows search protocol handler with an attributes parameter, matching the delivery technique that triggers remote ZIP extraction in the CVE-2023-36884 and CVE-2023-36584 chain reported by Unit 42. Abuse of the search-ms handler lures users into opening remote content while bypassing web-mark protections which is an early exploitation signal.

Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain

This rule detects wscript.exe executing a VBScript file extracted into the user Temp directory, matching the SmartScreen-bypass stage of the CVE-2023-36884 and CVE-2023-36584 exploit chain attributed to a Russian APT by Unit 42. Running script payloads unpacked from a downloaded archive under Temp is a common evasion of mark-of-the-web protections and signals user-driven initial execution.

Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup

This rule detects a batch script named remover.bat being executed and deleting itself, matching the anti-forensic cleanup routine of the Agonizing Serpens (Agrius) wiper toolset described by Unit 42. Destructive actors self-delete their loaders after wiping to hinder recovery and attribution which makes this a strong post-impact indicator.

Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens

This rule detects service or driver loading of the renamed vulnerable GMER driver AGMT.sys or the rentdrv2 driver used by Agonizing Serpens (Agrius) to disable endpoint security through a bring-your-own-vulnerable-driver technique. The actor abuses signed but exploitable drivers to terminate EDR processes by PID which blinds defenses ahead of wiper deployment.

Suspicious Localized Administrator Account and Group Enumeration After Citrix Bleed Exploitation

This rule detects net.exe enumeration targeting Spanish-localized privileged account and group names such as administrador and administradores, matching hands-on reconnaissance observed during Citrix Bleed post-exploitation by Unit 42. Attackers map local admin membership to plan privilege escalation which is unusual outside of interactive intrusion.

Suspicious Python HTTP Server Started for Payload Staging After Citrix Bleed Exploitation

This rule detects use of the Python built-in HTTP server module to host files on a local port, a hands-on-keyboard technique seen in Citrix Bleed (CVE-2023-4966) post-exploitation by Unit 42. Adversaries stand up an ad hoc web server to transfer tooling laterally which is rare on production endpoints and signals active intrusion.

Suspicious Impacket Remote Execution Tool Usage via process_creation

This rule detects command lines invoking the Impacket suite scripts smbexec, psexec, wmiexec, secretsdump and ntlmrelayx used for remote code execution and credential dumping. BlackCat operators used the Munchkin utility alongside these Impacket tools to move laterally and harvest credentials, so their execution outside sanctioned admin activity signals hands-on intrusion.

Suspicious Logon Event Enumeration via wevtutil via process_creation

This rule detects use of wevtutil to query security logon event IDs 4624 and 4672 for account and session hunting. Stately Taurus queried these events with wevtutil to map successful and privileged logons on compromised Southeast Asian government hosts, indicating attacker log enumeration during lateral movement preparation.

Suspicious Stately Taurus Masqueraded Service and Task Persistence via process_creation

This rule detects creation of services or scheduled tasks and run keys using the impostor names DISMsrv and TabletPCInputServices that mimic legitimate Windows components. Stately Taurus (Mustang Panda) established persistence for ToneShell and ShadowPad under these masqueraded names, so seeing them via service, task or registry tooling indicates attacker persistence.

Malicious InternalMonologue NTLM Downgrade Execution via process_creation

This rule detects execution of the InternalMonologue tool that abuses NTLM authentication downgrade to retrieve Net-NTLM responses without touching LSASS. Alloy Taurus used InternalMonologue to gather NTLM material during their government intrusion, making the tool name a reliable credential-access indicator.

Suspicious Stored Credential Enumeration via cmdkey via process_creation

This rule detects use of cmdkey with the list flag to enumerate stored Windows credentials in Credential Manager. Alloy Taurus ran cmdkey list alongside other credential discovery during their intrusion, so this command from an interactive or scripted context is an indicator of an attacker harvesting cached logon material.

Suspicious ProcDump LSASS Memory Dump via process_creation

This rule detects use of ProcDump to capture the memory of the LSASS process for offline credential extraction. Alloy Taurus operators dumped LSASS with ProcDump during their campaign against a Southeast Asian government target, and while ProcDump is a legitimate Sysinternals tool this specific target makes it a strong credential-access signal.

Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation

This rule detects command execution that writes reconnaissance output to the result2.dat file under the Windows Temp directory. Turla (Pensive Ursa) Kopiluwak dropper stages the results of systeminfo, tasklist, net, ipconfig and dir enumeration into this hardcoded artifact, so this combination reveals staged host discovery ahead of follow-on tasking.

Suspicious Named Pipe Access for Authentication Coercion (via pipe_created)

This rule detects access to the RPC named pipes abused by authentication coercion techniques such as PetitPotam and PrinterBug to force a target into authenticating to an attacker-controlled server. The spoolss, efsrpc, and eventlog pipes expose dangerous opnums that trigger outbound NTLM authentication. Detecting connections to these pipes surfaces coercion attempts that feed NTLM relay and privilege escalation.

Suspicious Named Pipe Created by Kazuar Backdoor for Interprocess Command Channel

This rule detects creation of named pipes whose names end in the Kazuar command channel suffixes PING, TASK or LOGS used by the Pensive Ursa (Turla) backdoor to coordinate injected components. Kazuar derives the pipe prefix from the machine GUID and appends fixed command keywords which reveals its interprocess control mechanism after injection into explorer.exe or svchost.exe.