Sigma detection rules, expert-reviewed

MuddyWater NetBird Deployment via Hardcoded Setup Key (via process_creation)

This rule detects NetBird being configured with the hardcoded setup key reused across MuddyWater samples targeting CFOs, a remote-access persistence behavior. Adversaries leverage a known setup key to silently enroll compromised hosts into their NetBird overlay network for hands-on access.

Malicious Firewall Deactivation - Firewall (via firewall-as)

This rule detects disabled the Windows Firewall to evade defense.

Malicious Microsoft Defender Threat Exclusion Added - Native (via windefend)

This rule detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities.

AsyncRAT Injector libPK.dll Written to Public Folder (via file_event)

This rule detects the native injector libPK.dll being written into the C users Public folder, a staging behavior of the AsyncRAT chain that later calls its Execute export to inject the payload. Adversaries leverage the shared Public directory to drop the injector where any user context can reach it.

FunkSec Ransomware Encryption Artifacts via funksec Extension and Markdown Ransom Note (via file_event)

This rule detects the on-disk artifacts of FunkSec ransomware, namely files renamed with the funksec extension and the dropped README markdown ransom note. Adversaries append a unique extension and write a ransom note during mass encryption, so these artifacts confirm active data-encryption for impact.

HamsaUpdate Wiper Trigger via F5UPDATER ConfirmDeleteFiles Argument (via process_creation)

This rule detects execution of the F5UPDATER wiper masquerading as an F5 update tool with the ConfirmDeleteFiles argument that triggers destructive file deletion without a confirmation prompt in Operation HamsaUpdate against Israeli infrastructure. The specific loader name paired with this argument marks the transition from staging to data destruction.

Suspicious Fake Crypto Wallet Installer Batch Script Staging (via file_event)

This rule detects creation of the distinctive numbered batch scripts staged by a fake cryptocurrency wallet installer that orchestrates hiding artifacts, terminating Explorer and deploying Remote Utilities. Adversaries drop these helper scripts during installation to sequence defense evasion and RMM setup, so their appearance on disk indicates the intrusion chain in progress.

Malicious Msiexec Installation of a Remote MSI Package (via process_creation)

This rule detects msiexec.exe installing a package directly from a remote HTTP or UNC location, a System Binary Proxy Execution pattern used to fetch and run attacker-controlled installers under a signed Microsoft binary. This LOLBin abuse appears in the Red Canary Threat Detection Report as a way to bypass application allowlisting and deliver second-stage payloads. Detecting remote msiexec installs surfaces the proxy-download-and-execute behavior.

Malicious LSASS Memory Access From a Non-System Process (via process_access)

This rule detects a process opening a handle to LSASS with memory-read access rights typical of credential-dumping tooling, while excluding the small set of legitimate operating-system components that normally interact with LSASS. Access to LSASS memory is a top credential-access technique in the Red Canary Threat Detection Report, yielding plaintext secrets and hashes for lateral movement. Alerting on non-system readers of LSASS surfaces dumping attempts across custom and off-the-shelf tools.

GateDoor Persistence via schtasks MicrosoftEdging Task (via process_creation)

This rule detects creation of a scheduled task named MicrosoftEdging through schtasks, the logon and idle persistence GateDoor establishes to relaunch its WebViewHost.exe loader. The task name masquerades as a Microsoft Edge component while pointing at attacker-controlled files under the roaming profile, making its creation a strong persistence indicator.

Suspicious Kimsuky AlphaSeed Artifacts in edge Hidden Directory (via file_event)

This rule detects creation of AlphaSeed working files inside the hidden .edge directory in the user profile, including the powermgmt.dat backdoor DLL, the cache_w.db keylog store and the schtaskw.exe self-copy. These files together in a hidden per-user folder are characteristic of a Kimsuky AlphaSeed infection staging keystroke capture and persistence.

Malicious Impacket Atexec Remote Scheduled Task Execution (via process_creation)

This rule detects the scheduled-task pattern used by Impacket atexec for remote command execution, where schtasks registers a one-off ONSTART task that runs cmd and redirects output to a temporary file for retrieval over SMB. Remote execution via scheduled tasks is a lateral-movement behavior in the Red Canary Threat Detection Report and a hallmark of hands-on-keyboard operators. Detecting this task-creation signature surfaces Impacket-driven lateral movement.

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

This rule detects the WMI Provider Host (WmiPrvSE.exe) spawning a command shell or script interpreter, an execution pattern that indicates local or remote code execution through Windows Management Instrumentation. WMI is a top execution and lateral-movement technique in the Red Canary Threat Detection Report because it runs under a trusted service and leaves little on disk. Detecting interpreter children of WmiPrvSE surfaces WMI-based hands-on activity.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

This rule detects PowerShell launched with an encoded command or an in-memory download-and-execute cradle on its command line, such as base64-encoded payloads or remote content pulled through Net.WebClient and piped into Invoke-Expression. PowerShell abuse is the single most prevalent technique in the Red Canary Threat Detection Report, used to stage and run payloads while evading disk-based controls. Flagging these command-line patterns catches the execution stage before follow-on activity.