Sigma detection rules, expert-reviewed

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

This rule detects a binary named mysql.exe running from a temporary directory with a hardcoded password argument, matching the HarborWatch RAT payload which is renamed to mysql.exe and requires a fixed pass value to execute. Genuine MySQL clients do not run from user temp folders.

Suspicious Domain Controller Discovery via nltest

This rule detects use of nltest to enumerate domain controllers and domain trust relationships, a reconnaissance step observed during CitrixBleed (CVE-2023-4966) post-exploitation. Attackers run this after gaining a foothold to map the Active Directory environment before lateral movement. Detecting the enumeration provides an early signal of hands-on-keyboard activity.

Malicious Octo Tempest Federation Persistence via AADInternals (via ps_script)

This rule detects use of the AADInternals PowerShell toolkit through its characteristic cmdlets. Octo Tempest leveraged AADInternals to forge Golden SAML tokens and manipulate Entra ID federation trust for persistent tenant access.

Malicious Matanbuchus Persistence via regsvr32 Silent Install with User Context (via process_creation)

This rule detects execution of regsvr32 with the no-register and user-context install flags to invoke a DLL entry point, the persistence and execution behavior run every five minutes by the Matanbuchus 3.0 EventLogBackupTask scheduled task. Adversaries leverage regsvr32 as a signed LOLBin to load a malicious DLL through its DllInstall path while bypassing DllRegisterServer monitoring, making early detection critical for surfacing loader persistence before payload deployment.

Suspicious Offensive Recon and Credential Tools Execution (via process_creation)

This rule detects execution of the fscan network scanner and the SharpDecryptPwd credential extraction utility. The SLOW#TEMPEST campaign used these tools for internal reconnaissance and browser credential theft.

Suspicious RegAsm Launched by Script Host (via process_creation)

This rule detects the .NET RegAsm utility being launched by a script host or Equation Editor. This steganography campaign injects Remcos, AgentTesla, and LimeRAT into RegAsm through process hollowing.

Suspicious Curl Download to Windows Temp via PowerShell (via process_creation)

This rule detects PowerShell invoking curl with follow-redirect to download a payload into the Windows Temp directory, a staging step in the SILENTCONNECT campaign delivering ScreenConnect. Observed in Elastic Security Labs telemetry where an execution-policy-bypassed PowerShell retrieves the next-stage installer for remote access.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Malicious System Recovery Inhibition via bcdedit Boot Configuration Changes (via process_creation)

This rule detects bcdedit disabling Windows recovery by setting recoveryenabled to No or bootstatuspolicy to ignoreallfailures, a recovery-inhibition behavior used by the Hunters International ransomware group per Group-IB. Adversaries alter the boot configuration to block automatic repair before encryption, making this a reliable pre-impact signal.

BURNBOOK DLL Sideloading via SumatraPDF.exe Loading libmupdf.dll from User Directory (via image_load)

This rule detects SumatraPDF.exe loading a libmupdf.dll from a user-writable directory such as Downloads or Temp, the DLL side-loading behavior used to launch the BURNBOOK loader delivered in a ZIP archive during Operation DreamJob intrusions. Adversaries pair a benign PDF reader with a malicious library to execute their loader under a trusted process.

Suspicious Cmd Using Curl to Download and Execute Payload (via process_creation)

This rule detects a cmd.exe command line that sets a small console mode, downloads a file with curl, and immediately starts it. This pattern matches loaders built with the MisterioLNK open-source builder.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.

Malicious NTDS.dit Access via esentutl Database Copy (via process_creation)

This rule detects esentutl.exe operating on the ntds.dit Active Directory database file, an operation used during this intrusion to copy or process the domain credential store extracted from a volume shadow copy. Adversaries leverage the esentutl LOLBin to handle the locked database and recover hashes, making detection of ntds.dit in its command line a strong credential-access signal.

Malicious Empyrean Stealer Run Key Persistence (via registry_set)

This rule detects creation of an autostart Run key named empyrean which the Empyrean information stealer uses to persist on the host. The stealer harvests browser credentials and Discord tokens and re-executes at every user logon through this value.

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.