Sigma detection rules, expert-reviewed

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

This rule detects PowerShell clearing Windows event logs by enumerating logs with Get-WinEvent and invoking ClearLog. The Qilin group wipes logs to destroy forensic evidence around encryption. Programmatic clearing of event logs is a hallmark anti-forensic action.

Suspicious Reflective Assembly Load in PowerShell (via ps_script)

This rule detects PowerShell script content that reflectively loads a .NET assembly directly from a base64-decoded byte array. This in-memory loading technique was observed in the SHADOW#REACTOR campaign to execute a .NET Reactor protected loader.

Suspicious PowerShell Invoking Remote HTA via Environment Variable Masquerading (via process_creation)

This rule detects PowerShell command lines that reference an environment-variable path together with a remote HTA URL. The CMSTP LNK loader uses this masquerading technique to launch mshta against attacker infrastructure.

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

This rule detects regsvr32.exe launched with the silent registration flags together with a remote scrobj.dll scriptlet reference, the classic Squiblydoo application whitelisting bypass. It is associated with campaigns that deliver regsvr32 execution through malicious Office documents as reported by Uptycs. Attackers use this to run remote COM scriptlets and proxy code execution past application controls, making it a high-value detection.

Possible n8n Campaign Datto RMM Relay Contact via centrastage.net

This rule detects DNS resolution of centrastage.net infrastructure associated with Datto RMM, which the n8n webhook campaign abuses as a remote management relay to control victim hosts. Because the domain also serves legitimate Datto RMM deployments, contact from an environment that does not sanction Datto is the meaningful signal. Correlate with unexpected RMM installers to confirm abuse.

Malicious JSP Webshell Written to SAP NetWeaver Servlet Directory

This rule detects creation of JSP webshell files with names observed in exploitation of the SAP NetWeaver CVE-2025-31324 file upload vulnerability inside servlet_jsp working directories. Adversaries drop these webshells to gain persistent remote command execution on the compromised application server. Detecting the file write surfaces web shell installation immediately after exploitation.

Malicious Web Shell Child Process Spawned by SAP Java Process (via process_creation)

This rule detects a SAP NetWeaver Java process spawning a command interpreter or reconnaissance utility such as cmd, PowerShell or whoami. Exploitation of CVE-2025-31324 drops a JSP web shell that executes commands through the Java runtime, so an interpreter child under the SAP Java process indicates post-exploitation web shell activity.

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

This rule detects creation of an alternate data stream named wtfbbq, an NTFS ADS MuddyWater uses to hide payload content from ordinary file listings. Storing data in a named stream conceals it from users and many tools. Detecting this distinctive stream name exposes ADS-based defense evasion.

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

This rule detects reg.exe writing Winlogon automatic-logon values by setting DefaultPassword together with AutoAdminLogon, a persistence and privilege-retention technique used in the Nitrogen BlackCat intrusion to plant a hardcoded backup domain account for reboot survival. Adversaries abuse AutoAdminLogon to store cleartext credentials and regain an interactive SYSTEM-adjacent session after the safeboot reboot, making it critical to surface before encryption.

Suspicious PythonLauncher Scheduled Task Creation via PowerShell Script

This rule detects PowerShell creating a scheduled task named with the PythonLauncher prefix, the logon persistence UAT-11795 registers for its Starland RAT as reported by Cisco Talos. The operators combine New-ScheduledTask with a PythonLauncher task name to relaunch the implant elevated at each logon. Matching this naming and API pattern reveals attacker persistence distinct from routine task creation.

Malicious Cloudflared Tunnel Established with Token

This rule detects cloudflared.exe running a tunnel with a token argument, a covert channel Huntress observed being launched through RMM tooling such as AgentPackageRunCommandInteractive to reach compromised MSP endpoints. Attackers use Cloudflare tunnels to proxy remote access past perimeter controls without inbound firewall changes. Token-based tunnel creation by cloudflared is a strong command-and-control indicator.

Suspicious curl Download to AppData Temp Directory (via process_creation)

This rule detects curl downloading remote content directly into the AppData Local Temp directory, the ingress technique DarkGate uses to stage its AutoIt loader and encrypted payload. Fetching executables into user Temp via curl is uncommon for legitimate software. Combined with an HTTP source this suggests malware staging.

Suspicious Node.js Spawning PowerShell Archive Download to Temp

This rule detects a Node.js process spawning PowerShell to download a compressed archive into the user temp directory, a chain seen when a malicious npm postinstall hook stages a payload. In the MUT-4831 campaign node.exe launched PowerShell to retrieve a zip that unpacked the Vidar infostealer. This process lineage is unusual for legitimate development workflows and points to supply chain compromise.

Suspicious PowerShell Payload Download via Invoke-WebRequest to status.php

This rule detects obfuscated PowerShell using Invoke-WebRequest to pull a payload from a status php endpoint. Fake IT support pages delivering Vidar staged the next stage through this download pattern. Scripted retrieval of remote executables from a status php gateway is a common loader beacon and delivery mechanism.

Suspicious javaw.exe Network Connection to Pastebin by D3F@CK Loader (via network_connection)

This rule detects the Java runtime javaw.exe establishing a network connection to Pastebin, the payload-retrieval behavior Red Canary observed from the signed D3F@CK loader that masqueraded as a Microsoft Teams installer. Java processes reaching out to paste sites are uncommon in enterprise environments, so this pairing indicates second-stage payload download from attacker-hosted text.