Sigma detection rules, expert-reviewed

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

This rule detects the MSSQL server process sqlservr.exe spawning a command interpreter, indicating xp_cmdshell abuse for operating system command execution as seen in the printer-and-BitLocker extortion scheme. Attackers exploiting exposed MSSQL instances use this to run arbitrary commands and stage further tooling on the host.

RedDelta MSI Installation via Hidden PowerShell WindowsInstaller COM Object (via process_creation)

This rule detects the RedDelta delivery command that drives a hidden PowerShell process to instantiate the WindowsInstaller COM object and silently install a remote MSI with REMOVE=ALL. Adversaries leverage the scripted installer COM interface to fetch and run payloads while suppressing the installer UI, making this command pattern a strong execution indicator.

Suspicious Mshta Autorun Persistence via Registry Set

This rule detects a Run key value pointing to mshta.exe, the registry persistence UAT-11795 plants to relaunch its Starland RAT loader at logon as reported by Cisco Talos. A HKCU Run entry that invokes mshta is highly atypical of legitimate software. Detecting it exposes autorun persistence tied to the script-based loader.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious UpdatusUser Local Account Creation by Secret Blizzard

This rule detects creation of a local account named UpdatusUser via net user. Microsoft attributed this masquerading account name to Secret Blizzard establishing persistence during its AiTM campaign. The name mimics a legitimate updater service but is created interactively, so this specific account name is a high-confidence persistence indicator.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation

This rule detects PowerShell script content that disables the Antimalware Scan Interface by reflecting into System.Management.Automation.AmsiUtils and setting the amsiInitFailed field to true. This in-memory AMSI bypass was observed during React2Shell CVE-2025-55182 exploitation to blind endpoint scanning before executing follow-on payloads.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Caching

This rule detects the WDigest UseLogonCredential registry value being set to 1, forcing Windows to cache plaintext credentials in memory as documented by Huntress. Attackers enable this setting before dumping LSASS so that cleartext passwords are recoverable. This modification undermines credential protection and is a strong precursor to credential harvesting.

Suspicious Windows Firewall Disabled via netsh by BlackByte Ransomware

This rule detects netsh disabling all Windows Firewall profiles, a defense evasion action used by BlackByte ransomware to remove network restrictions before spreading. Turning off all firewall profiles is rarely legitimate on managed endpoints.

Suspicious Hidden Window PowerShell with Modified Execution Policy (via process_creation)

This rule detects PowerShell launched with a hidden window and a bypassed or relaxed execution policy in a single command line. DragonForce and many ransomware loaders use this combination to run staging scripts silently, evading user awareness and default script-execution restrictions.

Suspicious Chrome Remote Desktop Host Silent Binding for Remote Access (via process_creation)

This rule detects headless registration of a Chrome Remote Desktop host using the start host binary with authorization code redirect and pin arguments, the remote access tool abuse observed in a Kimsuky campaign to obtain interactive control of victim machines. Adversaries leverage legitimate remote desktop software to blend with sanctioned IT tooling while retaining hands on keyboard access, making early detection critical for exposing unauthorized remote sessions.

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

This rule detects the VMware Tools guest process vmtoolsd.exe spawning a command interpreter such as cmd.exe or powershell.exe. Fire Ant abused hypervisor level access and CVE-2023-20867 to execute commands inside guest virtual machines from a compromised ESXi host, producing an unusual parent-child chain that does not occur during normal VMware Tools operation.

Malicious Local Administrator Added by Atera RMM Agent

This rule detects the AteraAgent process spawning net.exe to add an account to the local administrators group, an abuse chain Huntress observed during bulk attacks leveraging RMM tools against MSP-managed endpoints. Attackers who gain access to an RMM tenant push commands that create privileged accounts for persistence. Privileged account changes originating from an RMM agent are a strong indicator of tenant abuse.

Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)

This rule detects execution of an image whose name ends in a data-to-executable double extension such as .dat.exe, matching the STOCKSTAY chain where an HTA renamed a styles.dat payload to styles.dat.exe and ran it through WScript.Shell. Adversaries use double extensions to disguise executable payloads as inert data files, so running such a file is a strong masquerading indicator.

Suspicious FatalRAT Keylog File Creation in Windows Directory (via file_event)

This rule detects creation of the FatalRAT keylog artifact Fatal.key in the Windows directory. This behavior was observed in Operation SalmonSlalom where the backdoor recorded captured keystrokes to a fixed file for later collection. Detecting this artifact reveals credential and input capture activity on the host.