Sigma detection rules, expert-reviewed

Uncommon Domain Trust Discovery via Nltest (via process_creation)

This rule detects nltest.exe being used to enumerate domain controllers and domain trust relationships, a discovery step that adversaries and loaders such as those profiled in the Red Canary Threat Detection Report run to understand the Active Directory environment before moving laterally. Because interactive nltest trust enumeration is uncommon on typical endpoints, it is a useful early indicator of hands-on-keyboard reconnaissance. Detecting these queries surfaces the adversary orienting inside the domain.

Suspicious Shell Spawned by Langflow Python Process (via process_creation)

This rule detects a Langflow Python process spawning a command shell or network utility. Such a child process is consistent with the reverse shell payloads used against CVE-2025-3248. A Langflow worker does not normally launch interactive shells.

Suspicious bitsadmin Download to AppData Temp via ClickFix Revenge Chain

This rule detects bitsadmin.exe performing a transfer that downloads a remote http resource into the user AppData or Temp directory, the payload retrieval step of the ClickFix campaign following a Windows Run dialog paste. bitsadmin used interactively to fetch executables into user writable folders is a well known living off the land download technique. This catches the staging of the second stage binary.

Suspicious File Download via certutil

This rule detects certutil.exe being used with URL-cache download arguments to retrieve remote files, a living-off-the-land technique used by RansomHub affiliates to stage tooling. certutil is not a general purpose downloader, so its use to fetch remote content commonly indicates ingress tool transfer by an adversary.

Suspicious Boot Configuration Change to Safeboot Minimal via bcdedit

This rule detects use of bcdedit to set the boot configuration to safeboot minimal, forcing the host to reboot into Safe Mode where most endpoint security agents do not load. The ToyMaker intrusion used this to disable protections before hands-on-keyboard activity, so it is a high-confidence defense-evasion signal preceding credential theft or ransomware deployment.

Suspicious Active Directory Discovery via ADFind

This rule detects execution of the ADFind reconnaissance utility which Black Basta operators use to enumerate Active Directory users groups and computers during the discovery phase of an intrusion. While ADFind is a legitimate administrative tool its presence on endpoints is frequently associated with pre ransomware reconnaissance.

Malicious UAT-8302 Hidden PowerShell Execution of whatpc.ps1

This rule detects PowerShell running the whatpc.ps1 script with an execution policy bypass and a hidden window, matching the UAT-8302 reconnaissance stager. The named script drives host profiling and follow-on tasking while the hidden bypass flags suppress user visibility and controls. Execution of this specific script under these flags indicates active UAT-8302 operations.

Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)

This rule detects execution of the AdFind command-line Active Directory query tool, frequently staged by ransomware operators for domain reconnaissance. Fog and Akira operators deployed adfind.exe following SonicWall SSL VPN compromise to enumerate the domain.

Malicious Notepad++ Updater Chain via gup.exe Spawning update.exe (via process_creation)

This rule detects the Notepad++ GUP updater gup.exe spawning update.exe, the NSIS-based infection chain seen in the nation-state Notepad++ supply-chain compromise. The trusted updater is subverted to launch a malicious installer that side-loads the Chrysalis payload.

Malicious DtlCrashCatch DLL Side-Loading via OneDrive Sync Service by SPECTRALVIPER

This rule detects the OneDrive.Sync.Service.exe process loading DtlCrashCatch.dll, a side-loaded and injected module used by the SPECTRALVIPER backdoor. This activity is associated with the OceanLotus (APT32) espionage campaign that abuses a trusted signed OneDrive binary for DLL search-order hijacking. Catching this specific side-load is important because it reveals code injection and stealthy execution under a legitimate process context.

Malicious Direct etcd Write to Kubernetes Registry via ETCDCTL_API (via process_creation)

This rule detects direct writes to the Kubernetes object store held in etcd by invoking etcdctl v3 against the /registry key space. Attackers who compromise etcd use this to inject privileged pods or hidden namespace resources that never pass through the kube-apiserver. Bypassing the API server evades admission controllers and audit logging while granting node and cluster takeover.

Masquerading Kimsuky Registry Run Key Persistence for Malware Loader (via registry_set)

This rule detects creation of a CurrentVersion Run autorun value named NetService or WindowsSecurityCheck, the persistence behavior used by the Kimsuky KimJongRAT loader to relaunch its PE and PowerShell payloads at logon. Adversaries leverage benign sounding run key names to survive reboots while masquerading as system services, making early detection critical for surfacing persistence before data collection.

Suspicious Download to Windows appcompat Directory via PowerShell

This rule detects PowerShell using Invoke-WebRequest to write an executable into the Windows appcompat directory as observed after Triofox CVE-2025-12480 exploitation. Attackers stage payloads such as SAgentInstaller.exe in unusual system paths to evade attention.

Malicious Remote Desktop Enablement via Netsh

This rule detects netsh enabling the Remote Desktop service in the firewall to open inbound RDP for lateral movement. This was observed during Obscura ransomware deployment. Opening RDP on hosts that normally block it extends the attacker foothold across the network.

Suspicious NirSoft Credential Recovery Tools Execution

This rule detects execution of the NirSoft credential recovery tools netpass.exe and WebBrowserPassView.exe. The Christmas Miracle actor dropped these utilities to extract stored network and browser passwords. Their presence on a server indicates active credential harvesting by an intruder.