Sigma detection rules, expert-reviewed

Possible PetitPotam Coercion via IPC$ Named Pipe Access (via security)

This rule detects network share access in Event ID 5145 to the IPC$ share targeting sensitive RPC named pipes such as efsrpc and lsarpc used to coerce authentication. PetitPotam abuses the EFS RPC interface to force a host to authenticate to an attacker for NTLM relay. Coerced authentication relayed to ADCS or other services enables privilege escalation and domain takeover.

Possible Pass-the-Hash NTLM Network Logon (via security)

This rule detects network logons using the NTLM authentication package in Event ID 4624 with logon type 3, the pattern left behind by pass-the-hash lateral movement. Attackers reuse stolen NTLM hashes to authenticate to remote hosts without knowing the plaintext password. Hash reuse enables lateral movement and access to additional systems while blending with normal NTLM traffic.

Malicious APT15 Persistence via Nwsapagent Service or Run Key Registry Value

This rule detects registry modifications that register APT15 persistence under the Nwsapagent name in either a service key or an autorun Run key. Observed in NCC Group research on APT15 RoyalCli and RoyalDNS which persist via a Nwsapagent service and Run key. Masquerading persistence under a plausible service name is a hallmark of this espionage group.

Suspicious Winlogon Userinit Hijack for Persistence

This rule detects modification of the Winlogon Userinit value to a path other than the legitimate system userinit.exe, a logon persistence technique used by the Team9 malware family. Chaining an attacker binary into the Userinit key causes it to execute automatically during every interactive logon.

Malicious Team9 Persistence via BackUp Mgr Run Key

This rule detects creation of a Run key value named BackUp Mgr, a masquerading autostart entry used by the Team9 malware family to gain persistence at user logon. The benign-looking value name in an autorun location combined with a non-standard payload path is a strong indicator of Team9 persistence.

Possible SCOM RunAs Credential Theft via Access to Common MOMBins Encryption Key

This rule detects access to the System Center Operations Manager Common registry location holding the MOMBins encryption key used to protect stored RunAs credentials as described by NCC Group. Reading this key enables offline decryption of the SCOM credential store and recovery of privileged service account passwords.

Malicious NetHealth Run Key Persistence

This rule detects creation of a NETHEALTH autorun value under the CurrentVersion Run key pointing to a NetHealth executable in AppData Roaming, the persistence mechanism used in the Rapid Breach intrusion to relaunch the implant at logon. A masqueraded health-monitor name running from a user profile path indicates malicious persistence.

Suspicious Weakening of Certificate Binding Enforcement via Registry (via registry_set)

This rule detects changes to the StrongCertificateBindingEnforcement or SCHANNEL CertificateMappingMethods registry values that govern how certificates map to Active Directory accounts. Downgrading these controls re-enables weak certificate mapping abused in ADCS impersonation attacks. Relaxed binding lets a forged or requested certificate authenticate as a privileged account.

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

This rule detects modification of the DisableRestrictedAdmin LSA registry value which controls Restricted Admin mode for RDP. Ransomware operators set this to enable pass-the-hash style lateral movement over RDP without supplying plaintext credentials. Weakening this control aids credential reuse and lateral movement across the estate before encryption.

Suspicious Rogue Machine Account Creation via Powermad New-MachineAccount

This rule detects use of the Powermad New-MachineAccount cmdlet to create a rogue computer account in Active Directory, the first step of a resource-based constrained delegation attack that leads to privilege escalation. Creation of attacker-controlled machine accounts through this tooling is a strong indicator of an RBCD abuse chain.

Suspicious Download Utility Spawned by Java Process

This rule detects a Java process spawning a download utility such as curl or wget which is a common post exploitation pattern after Log4Shell remote code execution as described in NCC Group Log4Shell detection research. Adversaries use the compromised Java application to pull second stage payloads onto the host so a Java parented download tool warrants investigation.

Malicious Fivehands Go Encryptor Execution via Command Line Flags

This rule detects execution of the Fivehands Go based file encryptor identified by its characteristic command line flags key path blocks and full as described in NCC Group Fivehands ransomware research. The operator invokes the encryptor with a supplied key and target path to encrypt files and append the crypt extension which is the destructive final stage of the intrusion.

Suspicious Security Software Removal Batch Script Execution

This rule detects execution referencing batch scripts named to uninstall Sophos endpoint protection which Conti operators run to disable defenses before deploying ransomware. Observed in NCC Group research on Conti operations after the leaks using Removesophos and uninstallSophos batch files. Scripted removal of security tooling is a defense-evasion behavior that precedes impact.

Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration

This rule detects execution referencing a Rclone configuration file masquerading as a Windows host process file which Conti operators use to exfiltrate data to cloud storage. Observed in NCC Group research on Conti operations after the leaks using a renamed Rclone binary with a svchost.conf configuration. Cloud exfiltration via renamed Rclone is a common ransomware pre-encryption step.

Suspicious Cloud Exfiltration via Rclone

This rule detects execution of the rclone cloud sync utility with copy or sync operations, a data-exfiltration technique used by the Karakurt extortion actor to push staged files to attacker-controlled cloud storage. Bulk transfer of internal data to an external cloud provider is a strong sign of exfiltration ahead of extortion.