Sigma detection rules, expert-reviewed

Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)

This rule detects PowerShell reading the registry Applications key for mshta under the software classes hive using wildcarded paths, a lookup PEAKLIGHT performs to locate mshta for proxy execution. Programmatic resolution of the mshta binary path is an anti-analysis and living-off-the-land staging behavior.

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

This rule detects the command shell pattern used by Cobalt Strike's getsystem, in which cmd.exe echoes data into a named pipe to trigger SYSTEM token impersonation via a briefly created service. Cobalt Strike is among the most prevalent adversary tools in the Red Canary Threat Detection Report, and this privilege-escalation primitive is a high-fidelity signal of an active beacon. Detecting the echo-to-pipe command surfaces hands-on escalation.

Possible AppDomainManager Hijack via Application Config File (via file_event)

This rule detects creation of an update.exe.config application configuration file used by Screening Serpens for AppDomainManager injection with ETW disabled. The malicious config forces the .NET runtime to load an attacker assembly and blinds Event Tracing for Windows.

Suspicious ETW Bypass via PSEtwLogProvider Patching (via ps_script)

This rule detects PowerShell script content that reaches into the PSEtwLogProvider internal enabled flag to disable Event Tracing for Windows, an in-memory logging evasion used by the SEO poisoning infostealer. Patching this field blinds PowerShell script block telemetry. Legitimate scripts do not manipulate this private ETW provider field.

Renamed Execution of a Renamed Windows System Utility (via process_creation)

This rule detects a built-in Windows system utility running under a filename that does not match its embedded original binary name, exposing a mismatch between the PE OriginalFileName and the on-disk image. Renaming trusted utilities such as cmd, powershell, certutil or rundll32 is a defense-evasion technique highlighted in the Red Canary Threat Detection Report that lets adversaries slip past name-based detections and application controls. Alerting on the OriginalFileName-to-image mismatch surfaces the evasion regardless of the alias chosen.

Suspicious Expensive LDAP Query Reconnaissance

This rule detects Directory Service event 1644 recording expensive or inefficient LDAP search queries against a domain controller. This behavior matches LDAP-based reconnaissance where attackers issue broad filters to enumerate users, groups, and computers. A burst of expensive LDAP queries from unusual sources indicates active directory enumeration and should be correlated with the requesting host.

Suspicious Bitsadmin Transfer of CoinMiner Archive (via process_creation)

This rule detects bitsadmin.exe transferring a remote archive to download the XMRig CoinMiner as observed in the MS-SQL intrusion. Bitsadmin transfer jobs pulling zip payloads from external hosts are a known living off the land ingress technique.

Suspicious Deno Runtime Execution of Remote JavaScript Payload (via process_creation)

This rule detects the Deno JavaScript runtime executing a payload retrieved from a remote HTTP or HTTPS URL, the second stage of a ClickFix campaign that abuses the Deno runtime to deliver an infostealer. Legitimate use of Deno to run code directly from a remote web address on an endpoint is uncommon.

Suspicious NSSM Service Installation via process_creation

This rule detects the Non-Sucking Service Manager nssm.exe being used with the install argument to register an arbitrary program as a Windows service. Head Mare and Twelve used nssm to install persistence for masqueraded tunneling tools such as rclone and gost. Because nssm is not a default Windows binary its use to install services is a strong persistence signal.

Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation

This rule detects an IIS worker process spawning cmd or PowerShell that runs base64 encoded payloads, behavior observed during active exploitation of Gladinet CentreStack and Triofox local file inclusion flaws. Attackers leverage the web application context to achieve remote code execution and stage further tooling. Web servers rarely spawn encoded interpreters, so this indicates likely post-exploitation activity.

Suspicious Python Payload Execution from ProgramData via Pythonw (via process_creation)

This rule detects pythonw.exe executing a .pyw script staged under ProgramData, the loader behavior of the malicious PyPI packages that drop server.pyw to C ProgramData after installation. Running a windowless Python payload from ProgramData indicates supply-chain malware execution.

Suspicious SharePoint w3wp Spawning Encoded PowerShell (ToolShell Exploitation)

This rule detects the SharePoint IIS worker w3wp spawning PowerShell with an encoded command, the post exploitation activity following ToolShell webshell deployment. It matters because encoded PowerShell launched by the web server process indicates server side code execution and obfuscated attacker commands.

Malicious Software Protection Service Masquerade Outside System32 via Process Creation

This rule detects the legitimate software protection service binary name sppsvc being executed from any location other than System32 which reflects the masquerading observed in this intrusion where the process ran from a hidden ProgramData directory. The genuine service only runs from System32 so execution elsewhere indicates a masqueraded malicious process.

Suspicious Scheduled Task Masquerading as Memory Diagnostic Running Script Host

This rule detects creation of a scheduled task named RunFullMemoryDiagnostic or ProcessMemoryDiagnosticEvents whose action launches a script host, mimicking legitimate Windows memory diagnostic tasks. LitterDrifter abuses these trusted task names to blend its persistence into normal Windows components. The mismatch between the trusted name and a script host action reveals the worm persistence.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil.exe clearing Windows event logs which generates cleared-log events such as EventID 1102 and 104. LockBit operators wiped logs to destroy forensic evidence after exploitation and credential theft. Log clearing is a deliberate anti-forensic action rarely performed by legitimate administrators at scale.