Sigma detection rules, expert-reviewed

Suspicious Run Key Persistence Referencing SharePoint Executable via Registry Set

This rule detects a Run or RunOnce registry value pointing to an executable named SharePoint.exe, a masquerading persistence technique used by the Iranian actor Peach Sandstorm to launch its Tickler malware at logon. The use of a benign-sounding Microsoft product name in an autostart key helps the payload blend in and survive reboots.

Suspicious Renamed MonitoringHost Binary Indicating DLL Side-Loading

This rule detects execution of the signed Microsoft MonitoringHost binary under a renamed file name, a technique used by the SADBRIDGE loader to deploy the GOSAR (Golang QUASAR) backdoor. SADBRIDGE renames MonitoringHost.exe to DevQueryBroker.exe and abuses DLL search order hijacking to side-load a malicious HealthServiceRuntime.dll. Detecting a mismatch between the original file name and the on-disk image name surfaces this masquerading and side-loading activity for triage.

Possible Noodlophile Persistence via Run Key Launching Python Through cmd (via registry_set)

This rule detects a Registry Run key whose value launches a Python interpreter through cmd.exe, the persistence behavior used by the evolved Noodlophile stealer to re-run its Python payload at logon after DLL-sideloading delivery. Adversaries leverage a Run key that chains a command shell into an interpreter so the stealer survives reboots, making detection useful for surfacing persistence before repeated credential and browser-data theft.

Suspicious Security Software Discovery via tasklist and findstr (via process_creation)

This rule detects tasklist output piped into findstr to search for antivirus process names such as Bitdefender, ESET, Quick Heal and Sophos. The Lumma infostealer enumerates running security products this way to fingerprint defenses and adjust its behavior before credential theft.

Suspicious Active Directory Computer Export via csvde (via process_creation)

This rule detects csvde.exe exporting Active Directory computer objects with an objectClass=Computer filter, the reconnaissance step FIN7 used to enumerate hosts after MSIX-based access. csvde is rarely run interactively and an LDAP export of computer accounts maps the environment for lateral movement. This preceded NetSupport RAT and DiceLoader deployment.

Suspicious Security Process Enumeration via Tasklist And Findstr

This rule detects tasklist output piped through findstr to enumerate running processes, a discovery step CrazyHunter ransomware uses to locate security and endpoint tooling before disabling it. Filtering the process list for defensive products lets the operator plan evasion or termination. Chaining tasklist with findstr is uncommon in normal administrative use.

Malicious Event Log Clearing via wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensic step used by The Gentlemen ransomware operators to erase traces. Clearing logs destroys the evidence needed to reconstruct intrusion activity. This is a strong defense-evasion indicator on servers and workstations.

Suspicious Kubernetes Secret and Permission Enumeration via kubectl (via process_creation)

This rule detects kubectl invocations that enumerate permissions or read secrets, matching reconnaissance from the Hell's Keychain supply-chain research on IBM Cloud Databases for PostgreSQL. Attackers list allowed actions and dump secrets to find credentials for lateral movement. Broad secret enumeration from an unexpected principal is a strong discovery indicator.

MSSQL Server Process Spawning Command Shell via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning cmd.exe or PowerShell, the direct signature of xp_cmdshell abuse on an exposed database server. Huntress observed operators chaining bcp data staging and local account creation from this shell during MSSQL intrusions. A database engine launching command interpreters is not normal behavior and indicates code execution through the SQL layer.

Malicious LSASS Credential Dump via SilentProcessExit WerFault Abuse

This rule detects registry modifications under the Image File Execution Options SilentProcessExit or GlobalFlag keys for lsass.exe, the mechanism that forces WerFault.exe to write a full memory dump of the process. Adversaries abuse this Windows Error Reporting behavior to dump LSASS and extract credentials without a recognized dumping tool. These keys targeting lsass.exe have no legitimate use.

Suspicious Winlogon Shell Persistence via Registry by Key Group

This rule detects modification of the Winlogon Shell value to something other than the default explorer.exe, a persistence technique used by Key Group ransomware to auto-run its payload at logon. Any non-default shell value on this key indicates hijacked user-session startup and should be investigated.

Suspicious Spectre Ops Staging in CullinetProgram Directory via file_event

This rule detects the Spectre Ops stealer staging files inside a CullinetProgram directory under AppData Roaming, which it pairs with a Startup folder entry for persistence. The uniquely named working directory holds the malware components between reboots. This distinctive folder name is not associated with legitimate software and reliably marks the stealer footprint on disk.

Suspicious Command in RunMRU Registry Indicating ClickFix Execution (via registry_set)

This rule detects a RunMRU registry entry containing a script interpreter or download command, a host artifact left when a victim pastes a ClickFix payload into the Windows Run dialog. The RunMRU key records the exact command executed through Win plus R.

Suspicious Autorun Registry Key Pointing to User-Writable Path (via registry_set)

This rule detects a write to a Run or RunOnce autostart key whose value references an executable located in a user-writable directory such as AppData, Temp, ProgramData or the Public folder. Malware commonly plants persistence in these keys so its dropper re-runs at logon while living outside trusted program paths. An autorun entry pointing into a staging directory is a classic persistence indicator.

Suspicious HTA Download via mshta and Curl in Process Creation

This rule detects mshta being used together with curl to fetch and execute a remote HTA payload, the ClickFix delivery chain attributed to Scarlet Goldfinch. Victims are socially engineered into pasting a command that downloads and runs the HTA, giving the attacker code execution through a signed Windows binary that bypasses application controls.