Sigma detection rules, expert-reviewed

Suspicious Kimsuky Run Key Persistence via Masqueraded Value (via registry_set)

This rule detects creation of a Run key value named Everything, install or tdll, autostart names Kimsuky used to persist its PebbleDash based tools under benign looking labels. The autostart relaunches the implant at logon while masquerading as ordinary software. Detecting these value names surfaces registry persistence tied to the campaign.

Suspicious Privileged Docker Container Mounting Host Filesystem

This rule detects a privileged Docker container being started with the host root filesystem bind-mounted into it, a configuration used to break container isolation and read host secrets. It is associated with software supply chain attacks that abuse developer and CI Docker access to reach host credentials. Detecting privileged host-mount launches flags container escape and credential access attempts.

Suspicious Azure CLI Disk Snapshot and Copy for Data Theft

This rule detects Azure CLI commands that create a managed disk snapshot or clone a disk from an existing source. It maps to cloud data theft where an attacker snapshots a target VM disk and attaches a copy to an unmonitored instance to read its contents. Detecting it exposes disk exfiltration through the cloud control plane.

Suspicious Scheduled Task Creation Launching a Script Interpreter (via process_creation)

This rule detects schtasks.exe creating a scheduled task whose action runs a command shell, PowerShell or another script interpreter or a payload from a user-writable path. Scheduled Task abuse is a top persistence and execution technique in the Red Canary Threat Detection Report, letting adversaries survive reboots and run code on a trigger. Detecting task creation that wraps an interpreter or suspicious path surfaces the persistence attempt as it is registered.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects the rclone utility being run with copy, sync or transfer-tuning flags that indicate bulk movement of files to a remote cloud endpoint. Emotet-related intrusions abuse rclone to exfiltrate collected data to attacker cloud storage before disruptive follow-on activity. Automated cloud transfers driven from an endpoint are a common precursor to extortion and should be reviewed.

MintsLoader AMSI Bypass via amsiInitFailed Reflection (via ps_script)

This rule detects the MintsLoader in-memory AMSI bypass that reflectively sets the amsiInitFailed field on the AmsiUtils type to disable the Antimalware Scan Interface before staging the next payload. Adversaries leverage this bypass to run malicious PowerShell content without scanning, making it a high-confidence defense-evasion indicator.

Malicious Hiloti Configuration Registry Key Creation (via registry_set)

This rule detects creation of the Bfetipi registry key under the Windows software hive, a configuration and persistence artifact of the Hiloti DNS-tunneling malware observed in Unit 42 daily tunneling detections. This non-standard key name is unique to the malware family and indicates infection.

Malicious Port Forwarding Tunnel via Netsh Portproxy (via process_creation)

This rule detects netsh interface portproxy commands that create a local port-forwarding tunnel, which adversaries use to relay traffic through a compromised host and reach otherwise unreachable internal systems. Netsh portproxy tunneling is a command-and-control and lateral-movement technique in the Red Canary Threat Detection Report. Detecting the tunnel setup surfaces network pivoting through the endpoint.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Malicious Firewall Rule Any/any Created (via firewall-as)

This rule detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious Windows Subsystem for Linux (WSL) Installation - PowerShell (via powershell)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Suspicious pythonw.exe Executing LICENSE.txt Downloader from AppData

This rule detects a hidden pythonw.exe process launched from the AppData Local directory with a LICENSE.txt argument, matching an AI-themed lure that drops a Python downloader loading shellcode. Running a Python interpreter over a text file disguised as a license from a user writable path is a strong sign of staged malware execution.

Suspicious UAC Bypass via CMSTP INF Auto-Install

This rule detects execution of cmstp.exe with the auto-install switch pointing to an INF file, a technique used to bypass User Account Control and execute arbitrary commands at high integrity. The Sliver C2 framework and multiple threat actors abuse this living-off-the-land binary to elevate privileges while evading defenses. Detecting it early helps stop attacker privilege escalation before further post-exploitation activity.

Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)

This rule detects the signed DriverAssistant binary acvb.exe loading a wke.dll located alongside it, a DLL side-loading chain used to bypass UAC and launch FatalRAT. This behavior was observed in Operation SalmonSlalom against Chinese-speaking targets in APAC. Detecting the abnormal module load exposes the defense-evasion and execution stage of the loader.