Sigma detection rules, expert-reviewed

Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)

This rule detects wscript.exe spawning rundll32.exe to call the IternalJob export, the execution chain used by the BumbleBee loader launched from a VBS script via a scheduled task. The misspelled IternalJob export name is a specific loader artifact. This chain proxies malicious code execution through a signed binary to load BumbleBee and stage follow-on payloads.

Suspicious File Download via certutil URLCache (via process_creation)

This rule detects certutil being used with the urlcache option to retrieve a remote file over HTTP, a living-off-the-land download technique used via a webshell to fetch a backdoor in a ShadowPad intrusion. certutil is not a legitimate file downloader in normal administration. Using a signed binary to pull payloads evades application controls and network monitoring.

Suspicious AnyDesk Unattended Password Set via Piped Echo

This rule detects an AnyDesk unattended-access password being configured by piping a value through echo into the --set-password parameter, a scripted technique used by threat actors to enable silent remote access without user interaction. Programmatic password provisioning to AnyDesk is a strong indicator of malicious remote-access setup.

Suspicious 7za Archiver Executed from Windows Temp

This rule detects the standalone 7za.exe archiver running from the Windows Temp directory, matching SnapMC staging where data is compressed for exfiltration using a dropped command-line archiver. Execution of an archive utility from Temp outside any install path is a common data-collection precursor to exfiltration.

Malicious Data Exfiltration via MinIO Client from Windows Temp

This rule detects execution of the MinIO client with a config directory placed under Windows Temp as vmware.x combined with the insecure recursive copy flags used by the SnapMC actor to exfiltrate stolen data to attacker object storage. The masqueraded config path with TLS verification disabled is a strong indicator of automated bulk exfiltration.

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

This rule detects discovery command output being redirected into the Qlik Sense web-served fonts directory using the qle.ttf or qle.woff filenames, a data-staging technique used by Cactus ransomware operators after exploiting Qlik Sense to make recon results retrievable over HTTP. Writing whoami or quser output into a webroot fonts path is a strong indicator of hands-on-keyboard exploitation.

Suspicious ADCS Certificate Abuse Tooling via Command Line (via process_creation)

This rule detects command lines invoking ADCS abuse tools such as Certipy or Certify performing certificate requests against templates. These tools exploit misconfigured certificate templates to obtain certificates for arbitrary or privileged identities. Certificate-based authentication material grants durable access and privilege escalation across the domain.

Suspicious Data Exfiltration to Backblaze B2 via rclone (via process_creation)

This rule detects rclone copying data to a Backblaze B2 remote which was used to stage stolen data prior to BitLocker ransomware deployment. rclone to cloud storage is a common double-extortion exfiltration channel. Bulk transfer of files to attacker-controlled cloud storage precedes extortion and public leak threats.

Malicious DCSync Credential Dumping Tooling via Command Line (via process_creation)

This rule detects command lines invoking known DCSync implementations such as the mimikatz lsadump dcsync module or impacket secretsdump. These tools request directory replication to extract account password hashes from a domain controller. Recovering domain hashes including krbtgt enables golden ticket forgery and full domain compromise.

Suspicious Direct etcd Database Access via etcdctl With Server Certificates (via process_creation)

This rule detects execution of etcdctl using the etcd server certificates and the local etcd endpoint to read or write cluster state directly. Post-exploitation of a compromised etcd in Kubernetes clusters abuses this path to bypass the kube-apiserver and its admission controls. Direct database access lets an attacker read secrets or inject resources with full control over the cluster.

Malicious DLL Sideloaded by Microsoft Office Application

This rule detects a Microsoft Office application loading one of the specific DLLs abused for the MS15-132 DLL hijack such as elsext dll oci dll and the winrt forwarder library as described in NCC Group Office DLL hijacking research. Adversaries deliver a document with an OLE object via the browser that drops a malicious DLL next to the document so Office resolves and executes attacker code for initial access.

Malicious Office Persistence via WLL Add-In Dropped to Word STARTUP Folder

This rule detects creation of a Word add-in library file in the Microsoft Word STARTUP folder which the Sisfader RAT uses for persistence after CVE-2017-8570 exploitation. Observed in NCC Group research on CVE-2017-8570 RTF documents delivering the Sisfader RAT via an SCT to WLL chain. WLL add-ins auto-load with Word which makes this a reliable persistence detection.

Suspicious JSP Webshell Compiled Class Creation in Web Application Work Directory

This rule detects creation of a compiled JSP class named welcome_jsp associated with the webshell dropped during F5 and Citrix exploitation observed by NCC Group. Web application servers compile deployed JSP files into class artifacts and an unexpected welcome webshell class indicates server side code execution persistence.

Suspicious File Written to Startup Folder by DllHost COM Surrogate

This rule detects dllhost.exe writing files into the user Startup folder, matching Blister loader behaviour that abuses the IFileOperation COM interface via the DllHost surrogate to copy its payload for persistence while evading direct file-write monitoring. The COM surrogate is rarely a legitimate producer of Startup persistence artifacts and indicates staging of an auto-run payload.

Suspicious Rundll32 Copied to Startup Folder via Blister Loader

This rule detects a copy of rundll32.exe being written into the user Startup folder, a persistence technique used by the Blister loader which drops rundll32.exe alongside its own payload DLL to auto-run at logon. Placing a legitimate system binary outside System32 in a Startup path is a strong sign of DLL proxy execution being staged for persistence.