Sigma detection rules, expert-reviewed

Suspicious Playit.gg Tunnel Domain Resolution Used by XenoRAT (via dns_query)

This rule detects DNS resolution of playit.gg tunnel subdomains under the gl.at.ply.gg pattern used as XenoRAT command-and-control endpoints distributed through .gg domains and GitHub. Adversaries leverage the free playit.gg tunneling service to expose their RAT controller while hiding the true C2 host.

Suspicious Browser History Clearing via RunDll32 InetCpl ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to wipe browsing history and cached traces, an indicator-removal behavior used by the CylindricalCanine GoldenEyeDog subgroup during the DigiCert-linked intrusion. Adversaries clear these tracks to hinder investigation after credential and screenshot collection, making detection useful for surfacing anti-forensic activity on a compromised host.

Suspicious ClickFix Command Staged in RunMRU Registry Key

This rule detects an mshta, PowerShell, or HTTP-bearing command written into the Explorer RunMRU registry key, the artifact left when a user pastes a ClickFix lure into the Windows Run dialog. RunMRU records commands executed through Run, exposing the social engineering payload. Interpreter or URL strings in RunMRU are a reliable indicator of ClickFix execution.

Masquerading Certificate Issuance with Certighost cdc and rmd Request Attributes (via security)

This rule detects certificate issuance events carrying the cdc or rmd request attributes used by the Certighost CVE-2026-54121 exploit to steer a Certificate Authority toward an attacker-chosen client Domain Controller. Adversaries leverage these attributes to obtain a certificate that authenticates as a Domain Controller machine account, making early detection critical for exposing certificate-based DC impersonation before DCSync.

Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)

This rule detects the GootBot implant using the PowerShell Start-Job cmdlet to run base64-decoded payloads in background jobs, evading child-process monitoring. The pairing of Start-Job with a FromBase64String call inside a scriptblock is a strong indicator of in-memory loader activity. Routine administrative scripts seldom combine these.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry (UAT-7237)

This rule detects setting the LocalAccountTokenFilterPolicy registry value to 1, which disables remote UAC filtering and grants full administrative tokens to local accounts over the network. The UAT-7237 group enables this to facilitate lateral movement with local administrator credentials. This change weakens a key remote-access security control.

Suspicious Registry Run Key Modification For Persistence

This rule detects new or modified values under the Windows Run and RunOnce autostart keys observed through registry set telemetry. In the WithSecure Code Execution and Persistence Lab 2 payload paths are written to these keys to launch at logon. Attackers use autostart registry persistence to maintain access across reboots.

Malicious Ransomware Ransom Note README-RECOVER File Creation

This rule detects creation of README-RECOVER ransom note text files, the note naming convention dropped during the Qilin ransomware encryption stage. These notes appear across directories once mass file encryption completes. Their creation is a definitive indicator that ransomware impact has already occurred and requires immediate response.

Malicious Spool Process Spawned a CMD Shell - PrintNightmare Vulnerability - CVE-2021-36958 (via process_creation)

This rule detects exploits the PrintNightmare vulnerability and obtained a CMD shell.

Malicious Outlook Process Memory Dump via procdump

This rule detects procdump creating a full memory dump of the Outlook process, a technique the ToddyCat APT used to extract email data and credentials from memory. The attackers ran procdump64.exe with -ma against OUTLOOK.exe to capture its address space for later mining. Dumping the memory of a mail client is a strong sign of credential and email data theft rather than routine troubleshooting.

Malicious WebDAV Payload Execution via rundll32 davclnt.dll (via process_creation)

This rule detects rundll32.exe invoking DavSetCookie from davclnt.dll, a WebDAV execution technique used by the TimbreStealer campaign to run remote payloads. Executing through the WebDAV client library retrieves and launches code from a remote share under a signed binary.

Suspicious CrazyHunter Distribution Tool Connecting to File Server on Port 9999

This rule detects the CrazyHunter distribution binary file.exe establishing a network connection to a staging file server on TCP port 9999. During the intrusion the operators host payloads on an internal file server and pull them via this tool over the uncommon port 9999, so this traffic indicates lateral staging of ransomware components before encryption.

Suspicious PowerShell Download Cradle Using irm and iex via Interlock Loader (via process_creation)

This rule detects the MintLoader stage of Interlock intrusions which runs PowerShell with a hidden window and pipes an Invoke-RestMethod download directly into Invoke-Expression. This irm to iex pattern fetches and executes remote code in memory. It is a common but high signal initial access technique for this actor.

Malicious WDigest UseLogonCredential Enablement For Credential Theft

This rule detects the registry modification that sets WDigest UseLogonCredential to 1, forcing Windows to keep cleartext credentials in LSASS memory. The Qilin ransomware group enables this before dumping credentials to escalate and move laterally. Re-enabling plaintext credential caching is a deliberate precursor to LSASS harvesting.

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

This rule detects a binary named mysql.exe running from a temporary directory with a hardcoded password argument, matching the HarborWatch RAT payload which is renamed to mysql.exe and requires a fixed pass value to execute. Genuine MySQL clients do not run from user temp folders.