Sigma detection rules, expert-reviewed

Malicious Reverse SSH Tunnel via Plink for RDP Forwarding

This rule detects use of the Plink SSH client to establish a reverse tunnel that forwards local RDP back to attacker infrastructure which Conti operators use for persistent remote access. Observed in NCC Group research on Conti operations after the leaks using a renamed Plink binary over port 53. Reverse RDP tunneling through SSH is a strong indicator of hands-on-keyboard intrusion.

Suspicious Plink Reverse Tunnel Establishment

This rule detects a plink or renamed SSH client establishing a reverse port-forward tunnel using the -R option. UAT-5647 deployed a renamed plink binary such as iestatus.exe with -R to build a reverse SSH tunnel back to attacker infrastructure. Reverse SSH tunnels give attackers persistent interactive access and a pivot channel that bypasses inbound firewall restrictions.

Suspicious NTUSER.MAN Mandatory Profile File Created for Logon Persistence (via file_event)

This rule detects creation of an NTUSER.MAN mandatory user profile file inside a local user profile directory, a logon-persistence technique attributed to APT32 by 360 Advanced Threat Research in which a crafted binary registry hive is dropped as NTUSER.MAN so malicious autostart entries execute at user logon without administrative rights. Adversaries abuse the mandatory profile mechanism to load an attacker-built HKCU hive that never passes through the registry API, evading registry-callback based monitoring.

In-Memory Process Injection via Mavinject INJECTRUNNING (via process_creation)

This rule detects mavinject.exe called with the INJECTRUNNING flag, which injects a DLL into a running process through a signed Microsoft binary, a stealthy execution and defense-evasion technique. Mavinject abuse is tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces trusted-binary process injection.

Suspicious Registry Query for Stored Credentials (via process_creation)

This rule detects reg.exe querying registry locations for stored passwords or autologon credentials, an unsecured-credentials technique used to harvest plaintext secrets left in the registry. Searching the registry for credentials is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces credential discovery on the host.

Suspicious Hidden PowerShell Download Cradle via ClickFix (via process_creation)

This rule detects a hidden window PowerShell process invoking DownloadString to pull a remote second stage, matching the HarborWatch ClickFix chain that runs a base64 command to fetch code from a remote text file. A hidden PowerShell window combined with a web download is a strong indicator of scripted delivery.

Suspicious Run Key Persistence Pointing to Documents Folder (via registry_set)

This rule detects creation of a HKCU Run key whose value points to an executable hidden inside a user Documents subfolder, a persistence pattern used by the BundleBot stealer. Legitimate software installs to Program Files, so a Run entry launching a binary from the user Documents tree is a strong sign of malware autostart.

Suspicious Payload Download to Temp Masquerading as System32 File (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to save a payload into the temp directory under a system32 style filename. OneNote delivered malware wrote files such as system32.exe and system32.bat into the user temp path to blend in before launching them.

Possible MuddyWater C2 Domain Resolution

This rule detects DNS resolution of the domain screenai.online, a command-and-control host observed in a MuddyWater APT campaign that combined WMI execution and remote management tool abuse against Middle East targets. It captures beaconing infrastructure lookups tied to the intrusion. Detecting this is important because resolution of this campaign-specific domain is a high-confidence indicator of an infected host reaching out to attacker infrastructure.

Suspicious npm Credential Scan via whoami and npmrc Access

This rule detects the npm whoami identity check combined with access to the .npmrc credential file, a credential-harvesting step in the Shai Hulud 2.0 worm. The malicious payload queries npm /-/whoami and reads .npmrc to steal publishing tokens for propagating to further packages. Automated npm authentication probing paired with npmrc token access is a strong indicator of supply-chain credential theft.

Suspicious AdFind Active Directory Enumeration via OWASSRF Post-Exploitation (via process_creation)

This rule detects use of the AdFind reconnaissance utility by process name or by its characteristic query flags, a discovery step performed after OWASSRF exploitation of Exchange servers. Attackers enumerate domain accounts trusts and objects to plan lateral movement, so AdFind activity outside sanctioned administration is a hands-on-keyboard indicator.

Suspicious node Execution of sync.js from NodeJS Masquerade Directory

This rule detects node running a sync.js payload from a NodeJS named directory used as a masquerade staging location in the AsyncAPI npm supply chain compromise. Executing a sync.js loader from a fake NodeJS folder is the import-time payload delivery step that pulls the second stage from the attacker C2.

PipeShell Exfiltration Over Named Pipes (via powershell)

This rule detects establishes "PipeShell" connection(s) between a server and client(s) in order to move laterally or exfiltrate data. The server side will trigger "ServerStream" IOCs meanwhile the client side will trigger "ClientStream" IOCs. The rule works based on this condition, where at least 2 hosts need to trigger one of the condition.

Suspicious Certutil URL Download to Public Directory (Soco404 Cryptomining)

This rule detects certutil used with its urlcache flag to fetch a remote payload, the download technique of the Soco404 campaign that staged binaries under the Public user directory. It matters because certutil acting as a downloader is a living off the land pattern used to pull cryptomining payloads onto Windows hosts.

Suspicious NTDS Database Extraction from System Volume

This rule detects command-line references to the NTDS.dit Active Directory database being copied or dumped, a credential-theft step seen in CitrixBleed post-exploitation. Attackers extract NTDS.dit to harvest domain credential hashes for offline cracking and further compromise. Because access to this file outside of backup or DC maintenance is rare, it is a strong indicator of domain credential theft.