Sigma detection rules, expert-reviewed

Suspicious Cloudflare Tunnel Masquerading as conhost.exe During Medusa Operations (via process_creation)

This rule detects a binary named conhost.exe running Cloudflare tunnel arguments, a masquerade Storm-1175 uses by renaming the cloudflared client to conhost.exe to establish covert command and control during Medusa ransomware operations. Legitimate conhost.exe never runs tunnel parameters, so this combination surfaces a disguised tunneling channel used for remote access and exfiltration.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.

Malicious WinRing0 Vulnerable Driver Load

This rule detects loading of the WinRing0 kernel driver which the BlueSky actor deployed as a bring your own vulnerable driver to tamper with protected processes and disable security controls and this matters because this signed but abusable driver grants ring zero access and its presence outside of the few legitimate hardware utilities that ship it is a strong indicator of defense evasion.

Suspicious PowerShell Remote Script Execution From GitHub via irm and iex (via process_creation)

This rule detects the multi stage Windows campaign loader running PowerShell that pipes an Invoke-RestMethod download of a raw GitHub hosted script into Invoke-Expression for fileless execution. Fetching and executing raw GitHub content in memory is a hallmark of the initial loader. Later stages disable Defender and deploy a RAT and ransomware.

SystemNightmare by GentilKiwi - New External Device Added - CVE-2021-1675 / CVE-2021-34527 (via security)

This rule detects exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi.

Suspicious Winlogon Loading Keyboard Layout DLL kbdus1.dll

This rule detects winlogon.exe loading a DLL named kbdus1.dll, a keyboard-layout persistence technique used by Backdoor.Stupig to execute code as SYSTEM at logon. The legitimate keyboard file is kbdus.dll without the trailing digit.

Suspicious SearchIndexer Outbound Network Connection after Injection

This rule detects the Windows SearchIndexer process making outbound network connections to non local addresses. SolarMarker StellarInjector injects the SolarPhantom backdoor into SearchIndexer to run hVNC and stealer traffic from a trusted host. SearchIndexer should not initiate internet connections so this indicates code injection and C2.

Suspicious COLDRIVER BAITSWITCH Execution via Rundll32 Verifyme Export (via process_creation)

This rule detects rundll32 invoking a DLL export named verifyme as used by the COLDRIVER ClickFix chain to run the BAITSWITCH loader from a remote share. Rundll32 calling this export is characteristic of the campaign.

Suspicious Installed Software Enumeration via Registry Uninstall Key Query

This rule detects recursive querying of the registry Uninstall keys via reg to enumerate installed software which the RM3 banking malware performed during host profiling as documented by NCC Group. Enumerating installed products helps operators fingerprint the victim and identify security tooling before further action.

Suspicious XLoader Persistence via Policies Explorer Run Registry Key (via registry_set)

This rule detects writes to the Policies Explorer Run registry key, a less-common autostart location XLoader uses with randomized value names derived from the username to persist its hollowed payload. Adversaries prefer this key over the standard Run key to evade autostart monitoring that focuses on CurrentVersion Run, making detection useful for surfacing stealthy persistence ahead of credential theft.

Suspicious Scheduled Task Masquerading as DockerDesktop

This rule detects creation of a scheduled task referencing DockerDesktop.exe as its action, matching the persistence used by the FakeAgent malvertising campaign to relaunch a .NET RAT. The task name and target impersonate Docker Desktop to appear benign among legitimate application tasks. Scheduled task persistence naming a DockerDesktop binary created via schtasks is a campaign indicator.

Malicious Remote Payload Piped to Shell via wget on PAN-OS

This rule detects a remote payload being downloaded with wget and piped directly into a shell interpreter, a technique used in Operation MidnightEclipse to fetch second-stage tooling after exploiting CVE-2024-3400. Piping downloaded content straight to bash leaves no file on disk and is a common in-memory execution pattern. Detecting this reveals remote code retrieval and execution on the appliance.

Malicious Local Account Creation Masquerading as krbtgt (via process_creation)

This rule detects creation of a local account named krtbgt via net.exe, a homoglyph masquerade of the krbtgt account used by Lazarus in Operation Blacksmith. The rogue account provides persistent authenticated access while imitating a well-known service identity.

Suspicious File Search for Passwords via Findstr (via process_creation)

This rule detects findstr being used to search files recursively for the string password, an unsecured-credentials technique for locating secrets in configuration files and scripts. Searching files for passwords is tracked in the Red Canary Threat Detection Report. Detecting these searches surfaces credential hunting across the file system.

Suspicious Firewall Rule Added for Masqueraded csrss Process via netsh

This rule detects netsh advfirewall creating a firewall rule referencing a csrss-named program. Bundled malware masquerades its payload as the system process csrss and allows it through the firewall to enable C2 traffic. Combining a system-process name with an attacker-created firewall rule is a strong evasion signal.