Sigma detection rules, expert-reviewed

Malicious Local Administrator Account Added via net localgroup (via process_creation)

This rule detects use of net.exe to add an account to the local administrators group. North Korean actors exploiting TeamCity CVE-2023-42793 created and elevated a rogue account named krtbgt to establish privileged persistence.

Suspicious xp_cmdshell Enabled via sp_configure Reconfigure (via process_creation)

This rule detects command lines that enable the xp_cmdshell extended stored procedure through sp_configure and RECONFIGURE. Threat actors turned on xp_cmdshell to gain operating system command execution from a compromised SQL Server instance.

Malicious Cloud Instance Metadata Token Theft via IMDS Identity Endpoint (via process_creation)

This rule detects command lines requesting an OAuth token from the Azure instance metadata service identity endpoint at 169.254.169.254. Threat actors queried IMDS from a compromised SQL Server host to steal the managed identity token and move laterally into the cloud.

Malicious SQL Server Command Shell Spawn via sqlservr Child Process (via process_creation)

This rule detects the SQL Server engine process sqlservr.exe spawning a command shell or scripting interpreter. Threat actors enabled xp_cmdshell on a compromised SQL Server to run OS commands as a foothold before pivoting to the cloud environment.

Suspicious Peach Sandstorm Remote Access via AnyDesk Tooling (via process_creation)

This rule detects execution of the AnyDesk remote access utility. Peach Sandstorm deployed AnyDesk alongside custom tunneling to maintain hands-on-keyboard access to compromised high-value targets.

Suspicious Peach Sandstorm Entra ID and ARM Enumeration via AzureHound or Roadtools (via process_creation)

This rule detects execution of cloud directory enumeration tooling such as AzureHound and Roadtools roadrecon. Peach Sandstorm ran these tools to enumerate Entra ID and Azure Resource Manager objects during discovery for follow-on intelligence collection.

Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to a file. Flax Typhoon dumped these hives to extract local account password hashes for offline cracking and credential access.

Malicious PipeMagic Named Pipe Created for Modular Backdoor Communication

This rule detects creation of a named pipe following the PipeMagic pattern where the pipe name begins with 1. followed by a hexadecimal bot identifier. Microsoft documented this pipe naming convention as core to the PipeMagic modular backdoor for inter-module messaging. The distinctive numeric prefix is not used by legitimate software, so a matching pipe indicates the backdoor is active.

Malicious Storm-2561 DLL Sideloading via Fake Pulse Secure Directory (via image_load)

This rule detects DLL sideloading where dwmapi.dll or inspector.dll is loaded from a fake Pulse Secure directory under Common Files, the execution technique used by Storm-2561 to run credential-stealing code under a trusted-looking VPN process. The inspector.dll payload then reads the connectionstore.dat credential store, so loading these modules from the planted directory reveals active theft of VPN and stored credentials.

Suspicious rastls DLL Sideloading by kavp via Image Load

This rule detects the Symantec kavp.exe binary loading rastls.dll from outside a legitimate Symantec installation path, the DLL side-loading technique Secret Blizzard used to execute the Kazuar backdoor while abusing another group's tooling. A trusted security vendor binary loading its companion DLL from an unexpected location indicates a hijacked side-loading pair.

Suspicious SmallTiger Backdoor DLL Load via Image Load

This rule detects the load of SmallTiger.dll, the named backdoor DLL used by the North Korean actor Onyx Sleet to establish access on compromised hosts. The DLL is delivered and side-loaded during intrusions, so its presence in an image load event is a strong indicator of Onyx Sleet activity.

Suspicious DLL Search Order Hijack of clip.exe or wsmprovhost.exe (via image_load)

This rule detects the trusted binaries clip.exe or wsmprovhost.exe loading Version.dll or DSROLE.dll from a location outside the Windows system directories. North Korean actors abused DLL search-order hijacking against these binaries to execute their payload under a trusted process.

Malicious GigaWiper Ransomware File Extension .candy

This rule detects creation of files with the .candy extension, the marker appended to encrypted files by the GigaWiper destructive backdoor. A burst of files gaining this extension indicates active data destruction and encryption in progress across the host.

Suspicious ASPX Web Shell Drop on IIS Server

This rule detects creation of web shell files named Errors.aspx, Signoff.aspx or ghost.inc that were planted on internet-facing servers during a stealthy third-party compromise. Web shells give the attacker persistent remote command execution over HTTP which is a common foothold for follow-on lateral movement.

Malicious Marbled Dust OMServerService VBScript Dropped to Startup Folder

This rule detects the creation of OMServerService.vbs inside the Start Menu Startup folder. Microsoft observed the Marbled Dust actor abusing an Output Messenger zero-day to drop this file via path traversal for persistence. Placing a VBScript in the Startup folder guarantees execution at logon, so this file event strongly indicates the espionage intrusion.