Sigma detection rules, expert-reviewed

Malicious ServiceDll Hijack Of FontCacheSvc via Registry Set

This rule detects the ServiceDll value of the Font Cache service being pointed at apibridge.dll. ToddyCat hijacks the svchost-hosted FontCacheSvc service to load its malicious apibridge.dll for stealthy persistence, masquerading as a legitimate system service.

Suspicious SOCKS Proxy Autorun Registry Persistence via Registry Set

This rule detects a Run key persistence entry whose value references a SOCKS5 proxy component or the PerfLogs staging path. SystemBC establishes a SOCKS5 proxy for command-and-control and anchors it via an autorun registry value, combining persistence with proxy-based C2 tunneling.

Suspicious Process Made Critical via RtlSetProcessIsCritical (via ps_script)

This rule detects PowerShell invoking RtlSetProcessIsCritical to mark a process as critical as done by VenomRAT in the RevengeHotels campaign. Flagging a process critical causes the system to bugcheck if it is terminated which frustrates analyst attempts to kill the implant. This anti-analysis call is not used by normal PowerShell workloads.

Malicious Defender Exclusion Added for User Profile Path

This rule detects PowerShell using Add-MpPreference to add a Microsoft Defender exclusion covering the user profile directory which BrowserVenom uses to shield its staged payload from scanning. Excluding a broad writable path like the user profile is a common evasion before dropping the next stage. This weakening of Defender coverage is rarely legitimate on endpoints.

Malicious Active Directory ACL Manipulation via PowerView

This rule detects PowerView functions that grant domain object permissions or add members to privileged groups. The Twelve group abused Add-DomainObjectAcl and Add-DomainGroupMember to escalate privileges and establish persistence in Active Directory, which enables long-term domain control.

Suspicious Scheduled Task Enumeration for User_Feed_Sync via PowerShell (via ps_script)

This rule detects PowerShell enumerating scheduled tasks matching the User_Feed_Sync name pattern which the DuneQuixote campaign uses to locate its CR4T implant persistence task on compromised Middle Eastern government systems.

Malicious SessionGopher Credential Extraction via PowerShell (via ps_script)

This rule detects invocation of the SessionGopher tool through PowerShell which LockBit builder-based ransomware operators use to extract saved session credentials from PuTTY WinSCP and RDP prior to lateral movement and encryption.

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

This rule detects forced BitLocker volume encryption via manage-bde or the Enable-BitLocker cmdlet, the impact stage of the printer-and-BitLocker extortion scheme that encrypts victim disks for ransom. Attackers weaponize the built-in BitLocker feature to lock out victims without deploying custom ransomware, so unexpected encryption activity warrants investigation.

Suspicious MSSQL xp_cmdshell Enablement via sp_configure (via process_creation)

This rule detects command lines that enable the MSSQL xp_cmdshell feature through sp_configure, a preparatory step used in the printer-and-BitLocker extortion scheme to unlock operating system command execution from the database. Enabling xp_cmdshell is a strong indicator of an attacker preparing to run OS commands via a compromised SQL server.

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

This rule detects 7-Zip creating a password protected archive using the hardcoded password embedded in the GoSerpent backdoor tooling. The specific static password uniquely identifies the actor collection and exfiltration staging. Password protected archiving with this constant is a high-confidence collection indicator.

Suspicious Scheduled Task Masquerading as Apple Sync via schtasks

This rule detects creation of an hourly scheduled task named Apple Sync, used by OkoBot to persist a reverse SSH connection. Apple synchronization software does not register tasks through ad-hoc schtasks commands under this name. A benign sounding task establishing recurring execution indicates attacker persistence.

Suspicious Network Packet Capture via netsh trace

This rule detects netsh starting a trace capture session, used by The Gentlemen operators to sniff network traffic during the intrusion. Ad-hoc packet capture on servers is uncommon outside of active troubleshooting. This can reveal credential or reconnaissance activity and warrants review.

Suspicious Defender Protection Disabled via Set-MpPreference

This rule detects Set-MpPreference being used to disable Microsoft Defender protections, a tamper step used by The Gentlemen ransomware operators before deploying payloads. Disabling real-time or behavior monitoring removes the primary endpoint control. This is a high-value defense-evasion signal.

Suspicious Command Shell Spawned by lmadmin License Manager via process_creation

This rule detects the lmadmin.exe license manager spawning a command shell or PowerShell, indicating post-exploitation of the Schneider Electric vulnerability including SeImpersonate Potato style privilege escalation. The license service has no legitimate need to launch interactive shells. A shell child under lmadmin points to exploitation and follow-on execution.

Malicious LSASS Memory Dump via procdump

This rule detects procdump creating a full memory dump of the lsass.exe process to harvest credentials, as performed in the StrikeShark campaign. Dumping LSASS memory yields plaintext and hashed credentials for lateral movement. This is a strong credential-access indicator even though procdump is a legitimate Sysinternals tool.