Sigma detection rules, expert-reviewed

Suspicious Per Minute Scheduled Task Creation via schtasks via process_creation

This rule detects ZharkBot persistence that registers a scheduled task firing every single minute using schtasks with the SC MINUTE and MO 1 arguments. Such aggressive one minute recurrence is atypical of legitimate maintenance tasks and is used by the loader to guarantee frequent re-execution. The high frequency schedule pattern is a reliable behavioral indicator of malicious task based persistence.

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

This rule detects execution of the Live Ledger stealer disguised as Ledger Lives.exe, a typosquat of the legitimate Ledger Live wallet application. The malware targets cryptocurrency users and exfiltrates wallet material. The near identical process name is intended to blend with the real wallet client and is a reliable signal of the impersonation payload running.

Possible noPac sAMAccountName Spoofing via Machine Account Rename

This rule detects a computer account whose sAMAccountName is renamed away from its trailing dollar sign, the core step of the noPac privilege-escalation chain abusing CVE-2021-42278 and CVE-2021-42287. Renaming a machine account to impersonate a domain controller lets an attacker request Kerberos tickets that escalate to Domain Admin.

Malicious RBCD Delegation Attribute Modification

This rule detects modification of the msDS-AllowedToActOnBehalfOfOtherIdentity directory attribute, the write that configures resource-based constrained delegation and grants an attacker-controlled account the ability to impersonate users to a target host. Changes to this attribute outside sanctioned delegation management are a high-fidelity indicator of RBCD privilege escalation.

Possible Kerberoasting via RC4 Service Ticket Requests

This rule detects Kerberos service ticket requests using weak RC4-HMAC encryption from non-machine accounts, the core telemetry of Kerberoasting where an attacker requests SPN tickets to crack service account passwords offline. Machine and krbtgt requests are excluded so the remaining user-driven RC4 requests highlight likely credential-access activity.

Malicious Anonymous NTLM Network Logon (via security)

This rule detects Event ID 4624 network logons authenticated as ANONYMOUS LOGON using the NTLM package, a footprint of coerced authentication and NTLM relay activity such as PetitPotam. Anonymous NTLM network logons are unusual in a healthy environment. This pattern accompanies relay attacks that lead to credential compromise and lateral movement.

Possible PetitPotam Coercion via IPC$ Named Pipe Access (via security)

This rule detects network share access in Event ID 5145 to the IPC$ share targeting sensitive RPC named pipes such as efsrpc and lsarpc used to coerce authentication. PetitPotam abuses the EFS RPC interface to force a host to authenticate to an attacker for NTLM relay. Coerced authentication relayed to ADCS or other services enables privilege escalation and domain takeover.

Possible Pass-the-Hash NTLM Network Logon (via security)

This rule detects network logons using the NTLM authentication package in Event ID 4624 with logon type 3, the pattern left behind by pass-the-hash lateral movement. Attackers reuse stolen NTLM hashes to authenticate to remote hosts without knowing the plaintext password. Hash reuse enables lateral movement and access to additional systems while blending with normal NTLM traffic.

Malicious APT15 Persistence via Nwsapagent Service or Run Key Registry Value

This rule detects registry modifications that register APT15 persistence under the Nwsapagent name in either a service key or an autorun Run key. Observed in NCC Group research on APT15 RoyalCli and RoyalDNS which persist via a Nwsapagent service and Run key. Masquerading persistence under a plausible service name is a hallmark of this espionage group.

Suspicious Winlogon Userinit Hijack for Persistence

This rule detects modification of the Winlogon Userinit value to a path other than the legitimate system userinit.exe, a logon persistence technique used by the Team9 malware family. Chaining an attacker binary into the Userinit key causes it to execute automatically during every interactive logon.

Malicious Team9 Persistence via BackUp Mgr Run Key

This rule detects creation of a Run key value named BackUp Mgr, a masquerading autostart entry used by the Team9 malware family to gain persistence at user logon. The benign-looking value name in an autorun location combined with a non-standard payload path is a strong indicator of Team9 persistence.

Possible SCOM RunAs Credential Theft via Access to Common MOMBins Encryption Key

This rule detects access to the System Center Operations Manager Common registry location holding the MOMBins encryption key used to protect stored RunAs credentials as described by NCC Group. Reading this key enables offline decryption of the SCOM credential store and recovery of privileged service account passwords.

Malicious NetHealth Run Key Persistence

This rule detects creation of a NETHEALTH autorun value under the CurrentVersion Run key pointing to a NetHealth executable in AppData Roaming, the persistence mechanism used in the Rapid Breach intrusion to relaunch the implant at logon. A masqueraded health-monitor name running from a user profile path indicates malicious persistence.

Suspicious Weakening of Certificate Binding Enforcement via Registry (via registry_set)

This rule detects changes to the StrongCertificateBindingEnforcement or SCHANNEL CertificateMappingMethods registry values that govern how certificates map to Active Directory accounts. Downgrading these controls re-enables weak certificate mapping abused in ADCS impersonation attacks. Relaxed binding lets a forged or requested certificate authenticate as a privileged account.

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

This rule detects modification of the DisableRestrictedAdmin LSA registry value which controls Restricted Admin mode for RDP. Ransomware operators set this to enable pass-the-hash style lateral movement over RDP without supplying plaintext credentials. Weakening this control aids credential reuse and lateral movement across the estate before encryption.