Sigma detection rules, expert-reviewed

Malicious LOLBin Spawned by Outlook via MonikerLink CVE-2024-21413

This rule detects Microsoft Outlook spawning script interpreters or living off the land binaries such as mshta which is a hallmark of the MonikerLink CVE-2024-21413 exploitation chain. Successful exploitation lets an attacker bypass the Protected View warning and achieve code execution from a crafted email which makes any such child process highly suspicious.

Malicious CRYPTBASE.dll Side-Loading Outside System32

This rule detects CRYPTBASE.dll being loaded from a directory outside the Windows System32 folder. The CPU-Z and HWMonitor watering-hole campaign side-loaded a malicious CRYPTBASE.dll next to a trusted binary to hijack execution as reported by Kaspersky. Because the genuine CRYPTBASE.dll ships only in System32, loading it from any other path is a reliable DLL search-order hijack indicator.

Suspicious BitLocker FVE Policy Modification via Registry (via registry_set)

This rule detects writes to the HKLM SOFTWARE Policies Microsoft FVE registry policy keys which the ShrinkLocker ransomware sets to force BitLocker encryption behavior and enable drive locking against the victim.

Possible Shadow Credentials Abuse via msDS-KeyCredentialLink Modification

This rule detects modification of the msDS-KeyCredentialLink attribute on a directory object. Adversaries write key credentials to this attribute to perform certificate-based authentication as the target account, a technique known as Shadow Credentials used for persistence and credential theft.

Malicious Interlock Ransomware Ransom Note File Creation

This rule detects creation of ransom note files named README that Interlock ransomware writes across encrypted directories using the distinctive filename bang README bang txt. The unique note filename indicates active ransomware deployment and data encryption on the host.

Malicious Backup Catalog Deletion via Wbadmin (via process_creation)

This rule detects wbadmin being used to delete the backup catalog or system state backups. Ransomware destroys Windows Backup data so that administrators cannot restore files or system state after encryption. Deletion of backup catalogs is a deliberate recovery-inhibition step and rarely part of legitimate maintenance.

Windows Print.EXE Sensitive File Dump for Credential Access

Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.

Windows: WMIC service ChangeStartMode sets Manual or Disabled startup type

Detects wmic.exe commands changing a Windows service startup type to Manual or Disabled via ChangeStartMode.

Windows SFTP.exe Indirect Command Execution via ProxyCommand

Flags SFTP.exe executions that include ProxyCommand=, indicating potential indirect command execution.

Windows PUA: MemProcFS memory dump mounting via -device

Detects MemProcFS.exe execution with -device on Windows, consistent with mounting memory dumps for potential credential access.

Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts

Flags Windows file creation under Temp\_MEI* where NetExec nxc data files are dropped, indicating likely NetExec execution.

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

Windows Process Creation: curl Uploads to File-Sharing Domains

Detects curl commands on Windows uploading files to common file sharing/upload domains.

Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode

Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.