Sigma detection rules, expert-reviewed

Suspicious Azure Credential Hunting via MicroBurst Modules

This rule detects execution of MicroBurst secret-hunting PowerShell modules used to enumerate and extract credentials from Azure resources such as automation accounts, logic applications, and VM extensions. Such activity indicates cloud credential harvesting during an intrusion.

Malicious VOLTZITE NTDS.dit Credential Staging in Temp Directory (via process_creation)

This rule detects command lines that reference the Active Directory database file ntds.dit together with copy or staging operations into temporary and world-writable directories. VOLTZITE stages ntds.dit in local and temp folders to extract domain credentials from compromised infrastructure. Access to the domain database enables offline password hash extraction and broad lateral movement.

Malicious Ransomware Self-Deletion via Ping Loopback and Del

This rule detects a command line that pings the unusual loopback address 127.0.0.7 and then deletes a file, a self-removal and timing-delay technique used by Mamona ransomware after encryption. The non-standard loopback octet combined with a delete command is a strong anti-forensic indicator.

Obfuscated Lua Loader Execution via Compiler Loading LuaJIT Runtime (via image_load)

This rule detects a generically named Compiler.exe loading the LuaJIT runtime lua51.dll, the execution pattern used by the Lua malware to run an obfuscated Prometheus-protected script through FFI-driven Windows API calls. Adversaries leverage a Lua interpreter shipped alongside a benign compiler binary to execute logic in a scripting layer that resists static analysis, making early detection critical for surfacing the loader before scheduled-task persistence and C2 activity.

Suspicious Autorun Persistence Masquerading as Windows Security

This rule detects creation of a Run key value named Windows Security which the PXA Stealer campaign uses to disguise its autorun persistence as a legitimate security component. A benign looking value name combined with an autorun registry location is a common masquerading technique that warrants review of the referenced executable.

Suspicious Windows Service Creation via sc.exe

This rule detects creation of a new Windows service via sc.exe with a binary path argument. Adversaries register services for persistence and to execute payloads under SYSTEM. Because software installers also create services, review the binary path and service name for anomalies.

Malicious Payload Downloaded via PowerShell (via powershell)

This rule detects download a payload using PowerShell.

Malicious Boot Configuration Tampering via bcdedit (via process_creation)

This rule detects bcdedit commands that disable recovery options or manipulate boot configuration to support pre-OS persistence. DragonForce abuses bcdedit as part of a UEFI bootkit workflow and to inhibit Windows recovery, ensuring the compromise survives reboot and hampering remediation.

Suspicious Octo Tempest Remote Access and Tunneling Tooling (via process_creation)

This rule detects execution of remote monitoring and tunneling tools favored by Octo Tempest such as ScreenConnect Ngrok and Tailscale. The actor deployed these tools to maintain covert remote access and tunnel traffic out of victim networks.

Malicious spinstall0.aspx Webshell Written to SharePoint Layouts

This rule detects creation of the spinstall0.aspx webshell within the SharePoint LAYOUTS directory, the payload dropped by ToolShell exploitation to harvest machine key material. An aspx file written into the SharePoint application layouts path is a strong indicator of webshell installation.

Suspicious DLL Side-Loading via vssvc or WorkFolders

This rule detects the trusted binaries vssvc.exe or WorkFolders.exe loading a DLL from outside the Windows system directories. SideWinder abused DLL side-loading against these signed executables to run malicious code under a legitimate process, and loads from non-system paths indicate a planted DLL.

Malicious Follina MSDT Diagnostic Tool Code Execution (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool (msdt.exe) being invoked with Follina-style parameters such as PCWDiagnostic or IT_BrowseForFile, which the CVE-2022-30190 exploit uses to run attacker code from a weaponized document. MSDT abuse is a signed-binary code-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces document-driven exploitation before the payload executes.

Possible Host Port Scan from Single Source Address (via network_connection)

This rule detects a single source address initiating a high volume of TCP connections to many distinct destination ports on one host in a short window, indicating host port scanning. Observed in Elastic Security Labs detection engineering guidance where more than fifty distinct destination ports contacted rapidly reveals reconnaissance ahead of exploitation.

Suspicious SYSVOL Group Policy Preferences Access via Share Audit

This rule detects a user account reading machine level Group Policy Preferences files under the SYSVOL policies path through Windows detailed file share auditing as described in the WithSecure lab where GPP XML files were targeted for stored credentials. Interactive user access to machine policy XML files under SYSVOL frequently indicates hunting for cpassword secrets which is an early credential access and discovery signal.

Suspicious Hidden PowerShell Download Cradle via IEX (via process_creation)

This rule detects a hidden-window PowerShell process using a download cradle and IEX to execute remote content in memory. Amatera Stealer ClickFix lures pasted this pattern to pull and run the next stage.