Sigma detection rules, expert-reviewed

Suspicious DNS Zone Enumeration via dnscmd

This rule detects dnscmd.exe enumerating or printing DNS zones, a discovery technique used by espionage actors against Asian governments to map internal hosts and infrastructure from a compromised DNS server.

Possible UAC Bypass via ms-settings Shell Open Command Hijack (via registry_set)

This rule detects modification of the ms-settings shell open command registry value under HKCU which is the fodhelper.exe auto-elevation UAC bypass. Lunar Spider used this technique to elevate privileges without a consent prompt. The registry hijack redirects a trusted auto-elevating binary to run an attacker-controlled command with high integrity.

OpenSSH Server Firewall Configuration on Windows - PowerShell (via powershell)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

Malicious BlackByte Ransomware Host Marker via Control Panel Registry

This rule detects the international control panel values s1159 and s2359 being set to BLACKBYTE, a distinctive host-marking artifact created by BlackByte ransomware. BlackByte writes this value to tag infected systems.

Malicious Event Log Service Disabled via sc.exe (Soco404 Cryptomining)

This rule detects sc.exe stopping the Windows event log service, an anti forensic action used by the Soco404 cryptomining campaign to blind defenders. It is important because stopping event logging removes the primary source of endpoint telemetry during active intrusion.

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

This rule detects command lines invoking SharpDPAPI machine masterkey or machine credential functions, the tooling used to recover machine-scoped DPAPI keys and ultimately active ADFS signing keys in the observed intrusion. Adversaries extract these keys to decrypt protected secrets and forge SAML tokens for cloud access, so SharpDPAPI machine operations are a high-fidelity credential access indicator.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Suspicious BunnyLoader Keylog Capture File in AppData Temp (via file_event)

This rule detects creation of files matching the ADE_ prefix text file pattern in the local AppData Temp directory, the naming scheme BunnyLoader uses to stage captured keystrokes before exfiltration. Writing keylog output under this predictable path reflects the loader collection module in operation, marking active credential and data theft.

Malicious Chrome Extension Sideload via --load-extension from User-Writable Path (via process_creation)

This rule detects a Chromium-based browser launched with the --load-extension flag pointing to a user-writable AppData or Public directory. The Ducktail campaign drops a malicious extension into the Chrome User Data folder and injects it through a LNK shortcut using --load-extension to steal session cookies and hijack business accounts, so this command line indicates unauthorized extension loading.

ResolverRAT Loader DLL Sideloading via hpreader (via image_load)

This rule detects the legitimate signed hpreader.exe loading a DLL from a user-writable directory, the DLL sideloading behavior used by the ResolverRAT loader to reflectively execute its .NET payload in memory under a trusted process. Adversaries leverage sideloading against a signed binary to run malicious code with a benign parent, making early detection critical for surfacing the loader before registry persistence and encrypted C2 are established.

Malicious Network Login Performed to Multiple Targets (via security)

This rule detects would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.

Data Exfiltration to WebDAV Share via curl Upload

This rule detects curl uploading a file to a remote WebDAV endpoint using the upload flag. RedCurl uses this method to stage stolen data and logs to attacker controlled Nextcloud style cloud storage.

Suspicious Network Download Spawned by Node.js During Package Install

This rule detects the Node.js process spawning a download utility or command interpreter during an npm package install which the Stressed Pungsan campaign abuses through a malicious preinstall hook to fetch a second stage payload onto developer machines.

Suspicious Remote UAC Restriction Disabled via LocalAccountTokenFilterPolicy (via process_creation)

This rule detects a reg add command setting LocalAccountTokenFilterPolicy to 1, which disables remote UAC token filtering and grants full administrative access over the network to local accounts. Akira ransomware operators set this value to enable lateral movement with local administrator credentials.