Sigma detection rules, expert-reviewed

Suspicious TruffleHog Credential Scanner Execution in Developer Context (via process_creation)

This rule surfaces execution of the TruffleHog secret-scanning tool, which the Shai-Hulud 2.0 worm runs on infected hosts to harvest cloud and repository credentials from local files before exfiltrating them. Because TruffleHog is also a legitimate security tool, this behavior warrants review when it appears on developer or build systems outside sanctioned scanning, where it can indicate active credential theft.

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

This rule detects registration or use of a self-hosted GitHub Actions runner named SHA1HULUD, a distinctive artifact of the Shai-Hulud 2.0 supply chain worm as it establishes persistence in victim GitHub organizations. Adversaries register attacker-controlled runners to execute workflows and exfiltrate secrets from CI pipelines, so the hardcoded runner name is a high-confidence indicator of an active compromise.

Suspicious Remote Monitoring Tool Executing from GoAnywhere Directory

This rule detects remote monitoring and management tools such as SimpleHelp or MeshAgent executing from within a GoAnywhere installation directory. Microsoft observed attackers deploying these RMM tools under GoAnywhere folders following CVE-2025-10035 exploitation to maintain access. RMM binaries running from a file-transfer application path are out of place and indicate attacker-installed remote access.

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

This rule detects the GoAnywhere Tomcat process spawning powershell or cmd running host discovery commands such as whoami and systeminfo. Microsoft observed this chain during active exploitation of CVE-2025-10035 in GoAnywhere Managed File Transfer. A file-transfer web application launching reconnaissance commands indicates post-exploitation hands-on activity.

Suspicious Defender and Session Reconnaissance via sc query and quser

This rule detects reconnaissance querying the Microsoft Defender sense and windefend services with sc query. Microsoft observed Storm-0501 running these checks alongside quser and net commands before cloud-based ransomware deployment. Enumerating security service state is a precursor to evasion, so querying these specific services warrants scrutiny.

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

This rule detects certutil.exe adding a certificate to the root or CA store using the addstore and Enterprise options. Microsoft observed Secret Blizzard installing a rogue root certificate to enable adversary-in-the-middle interception of diplomat traffic. Trusting an attacker root certificate allows silent TLS decryption, so this command reveals the interception setup.

Suspicious mshta Executing Remote Content via ClickFix Lure

This rule detects mshta.exe launching remote HTA or scriptlet content from an HTTP or HTTPS URL. Microsoft observed Lumma Stealer delivered through ClickFix lures that pasted mshta commands pointing to attacker infrastructure. Using mshta as a proxy to run remote payloads bypasses application controls, so remote invocation is a reliable malicious signal.

Malicious Marbled Dust Backdoor Executing from Public Videos Directory

This rule detects execution of OMServerService.exe from the c\users\public\videos path. Microsoft attributed this GoLang backdoor to Marbled Dust in the Output Messenger espionage campaign. A service executable running from a world-writable public media folder is a clear misplacement of a legitimate-looking name, marking it as the deployed backdoor.

Suspicious node.exe Executing Compiled JavaScript Bytecode File

This rule detects the Node.js runtime launching a compiled JavaScript bytecode file with the .jsc extension. Microsoft observed threat actors distributing malware as .jsc payloads run by node.exe to obfuscate their logic. Executing compiled bytecode hides the script source from defenders and evades signature detection, so this pattern flags likely malicious Node.js execution.

Suspicious Microsoft Defender Exclusion Added for TEMP and PowerShell via Add-MpPreference

This rule detects use of Add-MpPreference to add Microsoft Defender exclusions for the user TEMP directory and the powershell.exe process. This behavior was observed in Node.js malvertising campaigns tracked by Microsoft that stage malicious payloads in TEMP. Attackers use it to blind endpoint protection before executing staged malware, so alerting on it exposes early defense evasion.

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

This rule detects the China Chopper web shell command marker &cd&echo in commands run by the IIS worker process, a hallmark of the web shells deployed against on-premises Exchange and SharePoint servers in these attacks. Adversaries use China Chopper to execute arbitrary commands through a compromised web application, so this distinctive command wrapper spawned by w3wp is a high-confidence web-shell indicator.

Suspicious Windows Event Log Cleared via wevtutil during Ransomware Staging (via process_creation)

This rule detects wevtutil clearing an event log, the anti-forensic action taken during the CLFS zero-day intrusion to erase evidence before ransomware encryption. Adversaries clear logs such as Application to hinder response after credential theft and recovery inhibition, so wevtutil cl outside sanctioned maintenance is an indicator of tampering.

Malicious System Recovery Inhibition via bcdedit and wbadmin before Ransomware (via process_creation)

This rule detects recovery-inhibition commands that disable Windows automatic recovery via bcdedit or delete the backup catalog via wbadmin, the pre-encryption destruction step in the CLFS zero-day intrusion that led to ransomware. Adversaries remove recovery options to maximize damage and pressure victims, so these commands appearing together with staging activity are a critical pre-ransomware indicator.

Malicious AutoHotKey Runner AutoNotify Executing AHKBot Looper Script (via process_creation)

This rule detects the legitimate AutoHotKey runner renamed AutoNotify.exe executing an .ahk script, the AHKBot Looper delivery mechanism used in tax-themed phishing campaigns that leads to screenshot exfiltration and follow-on payloads such as BRc4 and Latrodectus. Adversaries pair a benign AutoHotKey interpreter with a malicious script to run under a trusted-looking binary, so AutoNotify.exe driving an .ahk file is a high-signal execution indicator.

Suspicious mshta Launched from Explorer via ClickFix Run Dialog (via process_creation)

This rule detects mshta.exe launched directly by explorer.exe, the fingerprint of a ClickFix social-engineering lure that tricks a user into pasting a malicious command into the Windows Run dialog during this Booking.com impersonation campaign. Adversaries use the Run-dialog vector to execute mshta as a trusted LOLBin that stages XWorm, Lumma, VenomRAT, AsyncRAT, and NetSupport, so explorer spawning mshta is a high-signal execution indicator.