Sigma detection rules, expert-reviewed

Suspicious PIKABOT Command and Control Connection on Non-Standard Ports via Network Connection

This rule detects outbound connections to the uncommon high ports 2967 2223 and 5938 that PIKABOT uses for its HTTPS command and control while spoofing an Outlook user agent. These ports are atypical for normal web traffic so outbound sessions to them warrant review though some remote access software may reuse similar ranges.

Malicious Service Creation to Execute tscon for RDP Session Hijacking

This rule detects registration of a Windows service whose image path invokes tscon.exe with a destination session, the mechanism adversaries use to run tscon under the SYSTEM service context and hijack an inactive Remote Desktop session. Standalone tscon execution is insufficient for this technique, so a service wrapping tscon is a strong signal of session hijacking. Legitimate services do not invoke tscon in this manner.

Renamed Autohotkey Binary

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Malicious Clearing of Windows Event Logs (via process_creation)

This rule detects command-line clearing of Windows event logs through wevtutil or the PowerShell Clear-EventLog and Remove-EventLog cmdlets, an indicator-removal action used to destroy forensic evidence. Defense evasion via log tampering appears throughout the Red Canary Threat Detection Report, typically after an adversary has established access and wants to cover their tracks. Because legitimate bulk log-clearing on endpoints is rare, this is a high-fidelity signal of hands-on-keyboard activity.

Suspicious colorcpl.exe Spawned for Process Injection via Lua Loader (via process_creation)

This rule detects the TTF Trap loader creating colorcpl.exe in a suspended state as a host for shellcode injection. The Color Management applet colorcpl.exe is rarely launched programmatically and almost never by script interpreters or user path binaries. A colorcpl.exe child of such a parent indicates injection.

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.

Malicious File Copy via Esentutl Volume Shadow Access (via process_creation)

This rule detects esentutl.exe invoked with the /vss switch to copy a locked file such as ntds.dit or a credential database from a volume shadow copy, a credential-access technique that sidesteps file locks. Esentutl shadow-copy abuse is tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces theft of protected credential material.

Suspicious MSC File with Double Extension (via file_event)

This rule detects creation of a Microsoft Management Console file that uses a document double extension to disguise itself as a PDF. The FLUX#CONSOLE campaign delivered an ARRVL themed pdf.msc file to exploit MMC for payload execution.

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

This rule detects PowerShell piping CSV-formatted system inventory output into ConvertFrom-Csv and ConvertTo-Json, a recon idiom used by the Interlock backdoor. The malware wrapped systeminfo, tasklist and drive enumeration in this JSON conversion pipeline to serialize host data for exfiltration to its C2. The structured serialization of native recon commands distinguishes automated collection from routine administration.

Suspicious RisePro Stealer Password Dump File in Temp (via file_event)

This rule detects creation of a passwords.txt file inside a Temp folder which the RisePro information stealer writes when dumping harvested browser credentials before exfiltration. The stealer occasionally fails to clean up this artifact and leaves it on disk.

Suspicious TSVIPSrv.DLL Loaded From Non-System Path via DreamLoaders (via image_load)

This rule detects the TSVIPSrv.dll module being loaded from a location outside the Windows system directories, a technique used by DreamLoaders to run its loader through a malicious service. The genuine TSVIPSrv.dll ships only inside System32.

Suspicious RMM Daisy-Chain Action1 Spawning ScreenConnect via process_creation

This rule detects the Action1 RMM agent spawning a ScreenConnect client process. Threat actors daisy-chain remote management tools by using one deployed RMM to install and launch a second, giving them redundant remote access, so an Action1 process launching ScreenConnect indicates chained rogue RMM deployment rather than normal single-vendor management.

Suspicious IIS Logging Disabled via appcmd

This rule detects appcmd.exe being used to disable IIS request logging with the dontLog setting, matching defense-evasion activity in the Defence Impairment intrusion. Adversaries turn off IIS logging to hide webshell and web-based command execution from server logs. Disabling logging on a web server is a strong anti-forensic signal.

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

This rule detects rundll32.exe invoking a DLL staged in the user LocalAppData directory with a single character export ordinal, the loader behavior of the KimJongRAT sys.dll module that Kimsuky drops into the user profile. Adversaries leverage rundll32 as a signed proxy to execute their DLL under a trusted process, making early detection critical for surfacing loader activity before browser and credential theft.

Suspicious type Command Piping Encoded Log to Renamed git Binary (via process_creation)

This rule detects a command line that pipes the contents of glog.txt via the type command into the renamed git binary, the staging technique used by APT-C-60 to feed an encoded payload to its execution proxy. Reading a benign-looking log file and piping it into a proxied binary conceals the true payload source.