Sigma detection rules, expert-reviewed

NTFS Symbolic Link Configuration Change (via process_creation)

This rule detects modify the type of symbolic link than can be created.

Suspicious AutoIt Script Execution of AU3 Payload (via process_creation)

This rule detects an AutoIt interpreter executing an AU3 script, the execution stage DarkGate uses to decrypt and inject its payload. DarkGate operators abuse legitimate AutoIt binaries, often renamed, to run encrypted AU3 scripts. Legitimate AU3 execution exists, so pairing with staging context reduces noise.

Suspicious PowerShell Get-Content Piped to PowerShell (via process_creation)

This rule detects PowerShell reading a file with Get-Content and piping the result through Out-String into another PowerShell instance. The STEADY#URSA campaign used this pattern to execute the covert SUBTLE-PAWS backdoor stager.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware

This rule detects the LocalAccountTokenFilterPolicy registry value being set to one, which disables remote UAC filtering and grants full administrative access for local accounts over the network. BlackByte ransomware sets this value to ease lateral movement.

Malicious NTDS Database Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating a full copy of the Active Directory database, the credential theft step Volt Typhoon performs to obtain the domain NTDS.dit file and all account hashes. Dumping the directory database enables offline cracking and domain wide impersonation, so this operation on a domain controller is a high confidence indicator of hands on keyboard credential access.

Malicious AMSI Bypass via PowerShell amsiInitFailed Patch

This rule detects PowerShell reflection that flips the AMSI amsiInitFailed field to disable in-memory script scanning. Fake browser update chains delivering BitRAT and Lumma Stealer used this to blind AMSI before reflective .NET loading. Disabling AMSI removes a primary defense against staged malicious payloads.

Suspicious Windows Service Executing Batch File from Temp Directory

This rule detects Windows service creation whose ImagePath runs cmd.exe against a batch file staged in a temp directory, observed by Huntress where a masquerading service named WebrootCheck launched a batch file from c colon temp. Attackers register a legitimate-looking service to execute attacker scripts with SYSTEM privileges and persist. A service that runs a temp-directory batch file combines a benign-looking name with a suspicious execution context and is a strong persistence indicator.

Suspicious Level.io RMM Silent Install via PowerShell (via ps_script)

This rule detects a PowerShell one-liner pulling the Level.io RMM installer from downloads.level.io, abused as unauthorized remote access tooling during a ransomware precursor intrusion. Threat actors deploy Level.io alongside Cobalt Strike on a unified command-and-control channel to retain persistent control. Unexpected RMM installation is a strong sign of adversary tradecraft.

Malicious PRT Token Forging via AADInternals (via ps_script)

This rule detects AADInternals cmdlets that mint or export Primary Refresh Token material and device certificates for cloud identity abuse. The cloud lateral-movement research shows attackers use these to forge tokens and access cloud resources as the victim. The cmdlet names are specific to this toolkit and indicate token theft or forgery.

Malicious Hidden PowerShell Execution From PerfLogs via Process Creation

This rule detects PowerShell launched with a hidden window that references an executable under the PerfLogs directory. The DroxiDat and SystemBC intrusion staged payloads such as hos.exe in C:\perflogs and executed them through hidden PowerShell, a technique used to run malware from an unusual location while suppressing any visible window.

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

This rule detects mstsc.exe writing _TS prefixed temporary files, the bitmap cache artifacts produced when a victim connects to a rogue RDP server delivering redirected remote applications. Presence of these client cache files corroborates outbound rogue RDP sessions used for data access.

Malicious Security Service Deletion via Sc

This rule detects sc.exe deleting Microsoft Defender and EDR related services such as Sense, WdFilter, or SgrmAgent, permanently removing protection components. This tampering is a hallmark of ransomware playbooks that disable endpoint defenses before impact. Deleting these services blinds detection and prevents recovery of protection without reinstallation.

Suspicious Scheduled Task Named ServiceHub.TestWindowStoreHost by Mustang Panda

This rule detects creation of a scheduled task named ServiceHub.TestWindowStoreHost, a persistence artifact associated with the TONESHELL variant used by Mustang Panda. The task name masquerades as a legitimate Visual Studio service component.

Suspicious Azure Credential Hunting via MicroBurst Modules

This rule detects execution of MicroBurst secret-hunting PowerShell modules used to enumerate and extract credentials from Azure resources such as automation accounts, logic applications, and VM extensions. Such activity indicates cloud credential harvesting during an intrusion.

Malicious VOLTZITE NTDS.dit Credential Staging in Temp Directory (via process_creation)

This rule detects command lines that reference the Active Directory database file ntds.dit together with copy or staging operations into temporary and world-writable directories. VOLTZITE stages ntds.dit in local and temp folders to extract domain credentials from compromised infrastructure. Access to the domain database enables offline password hash extraction and broad lateral movement.