Sigma detection rules, expert-reviewed

Suspicious Remote Desktop Enablement via netsh Firewall Rule (via process_creation)

This rule detects netsh being used to open the firewall for Remote Desktop connections. Black Basta enables inbound RDP to move laterally and maintain interactive access, so a netsh firewall change referencing Remote Desktop is an indicator of lateral movement preparation.

Malicious File Download via Certutil URL Cache (via process_creation)

This rule detects certutil being used with its URL cache and split switches to download a remote file over HTTP. The BadPilot campaign abuses certutil as a living-off-the-land downloader to fetch additional tooling, so this ingress-tool-transfer pattern indicates staging of second-stage payloads.

Suspicious LSASS Memory Dump via Renamed ProcDump (via process_creation)

This rule detects a ProcDump-style full memory dump of the lsass process regardless of the binary name on disk. The BadPilot campaign renames procdump and invokes it with the full-dump and accept-eula switches against lsass to harvest credentials, so this command-line pattern captures the technique even when the tool is renamed.

Malicious SAM and SYSTEM Registry Hive Credential Dump via reg.exe (via process_creation)

This rule detects reg.exe saving the SAM, SYSTEM or SECURITY registry hives to disk. The BadPilot campaign exports these hives to extract local account password hashes offline, so a reg save targeting credential hives is a high-confidence credential access indicator.

Possible SocGholish Update Task Running Batch File at Highest Privileges (via process_creation)

This rule detects creation of a scheduled task via schtasks that runs a batch file at the highest privilege level on a short recurring interval. SocGholish registers an Update task that launches a batch script every ten minutes with elevated rights, so this combination of highest run level and a batch payload signals persistent malicious execution.

Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)

This rule detects schtasks being launched by cmd or PowerShell to create a scheduled task that points at a payload located in a world-writable directory such as Users Public, PerfLogs or ProgramData. This pattern is used by SocGholish to persist a recurring task that executes staged tooling, indicating establishment of scheduled-task persistence.

Suspicious AnyDesk Execution from Temporary or System Directory (via process_creation)

This rule detects the AnyDesk binary executing from a temporary, ProgramData or System32 directory rather than a normal installation path. Adversaries drop portable AnyDesk into staging directories to gain remote access without a full install, so execution from these locations is a strong sign of RMM abuse rather than sanctioned use.

Suspicious MeshAgent Spawning Command Interpreter (via process_creation)

This rule detects the MeshAgent remote management binary spawning a command interpreter or scheduling utility such as PowerShell, cmd or schtasks. Adversaries abusing MeshCentral use the agent to execute follow-on commands and establish persistence, so an interpreter child under MeshAgent indicates hands-on-keyboard misuse of the RMM tool.

Suspicious AnyDesk Unattended Access Password Set via Command Line (via process_creation)

This rule detects AnyDesk being invoked with the set-password command-line switch to configure an unattended access password. Adversaries abusing remote monitoring and management tooling silently set an unattended password so they can reconnect to the host at will, turning legitimate RMM software into a persistent remote access channel.

Malicious PsExec Service Binary Execution from Windows Directory via services.exe (via process_creation)

This rule detects services.exe spawning a randomly named eight-character executable located directly in the Windows or System32 directory. This behaviour is characteristic of PsExec-style remote service execution used by adversaries for lateral movement, where the tooling drops and launches a service binary under a random name to blend in with legitimate service activity.

Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques

This rule detects PowerShell launched with an encoded command argument, an obfuscation technique used in trending Chinese APT operations to hide malicious script content. Attackers pass Base64-encoded commands to evade command-line inspection, so encoded PowerShell invocations are a common defense-evasion behavior that benefits from execution review.

Suspicious Port Forwarding via Netsh PortProxy Linked to Chinese APT Techniques

This rule detects netsh configuring an interface portproxy rule, a traffic-relay technique used in trending Chinese APT operations to pivot through compromised hosts. Attackers add portproxy forwarding to tunnel access to internal systems, so netsh portproxy additions are a meaningful internal proxy and pivot indicator.

Suspicious WerFault Masquerade Executing From Non-System Path Linked to Turla Snake

This rule detects a process named WerFault.exe running from a directory other than System32 or SysWOW64, a masquerading technique used by Turla Snake malware which hides in the WinSxS tree. The legitimate Windows Error Reporting binary only runs from system directories, so a WerFault image outside them is a high-confidence indicator of this masquerade and service abuse.

Suspicious Impacket WMIExec Command Execution Pattern Linked to Salt Typhoon

This rule detects the command shell being spawned with the quiet-mode output-redirection pattern that Impacket wmiexec uses to capture results over an admin share, a remote-execution technique used by Salt Typhoon. The tool runs cmd with /Q /c and redirects output to a file on ADMIN$, so this distinctive command structure is a strong indicator of Impacket-based lateral movement.

Suspicious File Download via CertUtil Linked to Salt Typhoon

This rule detects certutil.exe used with URL cache or decode switches to retrieve or stage remote content, an ingress tool transfer technique used by Salt Typhoon. Attackers abuse this signed LOLBin to pull payloads while evading download controls, so certutil download and decode invocations are a well-known malicious tradecraft signal.