Sigma detection rules, expert-reviewed

Suspicious PowerShell COM-Based Script Execution and HTTP Retrieval (via ps_script)

This rule detects PowerShell script content that instantiates the MSScriptControl COM object alongside ServerXMLHTTP for command retrieval. The STEADY#URSA SUBTLE-PAWS backdoor used this combination to fetch and run C2 commands.

Suspicious Data Exfiltration via TFTP Client

This rule detects execution of the TFTP client, a non-standard egress protocol abused for covert data exfiltration as described by Elastic. Adversaries use the trivial file transfer protocol to move data out over an uncommon channel that often evades web focused monitoring. TFTP is rarely used on modern endpoints so its execution warrants review for exfiltration or ingress tooling.

Suspicious File Content Wiping via fsutil setzerodata (via process_creation)

This rule detects fsutil being used to zero out file contents through the setzerodata operation. LockBit uses fsutil to overwrite files with zeros to frustrate recovery and forensic analysis, so this command indicates destructive impact activity.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects execution of the Rclone utility with copy or sync arguments to a configured remote. Actors in this App Installer campaign staged Rclone to exfiltrate data to cloud storage prior to Black Basta ransomware deployment.

Suspicious Executable Started from Windows Help Directory via Process Creation

This rule detects execution of a portable executable located in the Windows help directory which is abnormal for that folder and was used by the REF5961 intrusion set to run the RUDEBIRD loader from C\Windows\help. Attackers place binaries there to masquerade as benign system content and evade path-based scrutiny.

Suspicious Scheduled Task Executing JavaScript from Public Directory (via process_creation)

This rule detects creation of a scheduled task that executes a JavaScript file from the Users Public Downloads directory. The Caminho loader registered tasks named amandes or amandines to run a persistence script from this world-writable location every minute.

Suspicious Java Runtime Execution from LocalAppData Staging Folder

This rule detects javaw executing from a user LocalAppData staging directory used by the Xeno stealer. The malware bundles a private Java runtime under Java and Microsoft GameDVR paths to run its malicious JAR while blending in with normal directories.

Malicious Active Directory Database Dump via ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked to create a full Install-From-Media snapshot of the Active Directory database, the credential-dumping step observed on domain controllers prior to NTDS.dit exfiltration. Adversaries leverage ntdsutil to extract every domain hash in one operation, making detection of the IFM and full snapshot subcommands critical for catching domain-wide credential theft.

BitLocker Feature Installation via ServerManagerCmd or PowerShell (via process_creation)

This rule detects on-demand installation of the BitLocker Windows feature through ServerManagerCmd or Install-WindowsFeature, the enabling step ShrinkLocker performs on systems where BitLocker is absent before hijacking it to encrypt drives. Adversaries leverage the native BitLocker feature to lock victim data without dropping a custom encryptor, so this behavior warrants review on hosts where BitLocker deployment is unexpected.

Suspicious Scheduled Task Creation Running DLL from ProgramData

This rule detects schtasks.exe creating a scheduled task whose action invokes rundll32 against a DLL located in ProgramData, matching the persistence mechanism of the WARMCOOKIE backdoor. Adversaries register such tasks so the loader runs automatically after reboot or logon.

Malicious VenomRAT Offline Keylog File Creation via file_event

This rule detects creation of the DataLogs_keylog_offline keystroke capture file that VenomRAT writes under the user AppData MyData directory. This hardcoded artifact path marks active offline keylogging by the VenomRAT payload delivered through the fake CVE-2023-40477 proof-of-concept, indicating credential and data theft on the host.

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

This rule detects forfiles.exe enumerating win.ini and using its command flag to launch PowerShell and mshta, matching the PEAKLIGHT LNK-driven infection chain that abuses forfiles as a proxy execution binary. This technique launches a memory-only downloader while evading direct process lineage detection.

Suspicious Application Shim Database Registration via Registry Set

This rule detects registration of a custom application shim database under the AppCompatFlags Custom and InstalledSDB registry keys, the persistence and injection technique detailed in the SHIM Me What You Got research abusing sysmain.sdb. Adversaries install malicious shims to inject code and persist, so unexpected SDB registrations warrant review.

Malicious Remote Process Execution From an SMB Admin Share (via process_creation)

This rule detects a process whose image is executed directly from a remote SMB administrative share (a UNC path into ADMIN$ or C$), a lateral-movement pattern used to run tools copied to a remote host. Lateral movement over admin shares is featured in the Red Canary Threat Detection Report and underpins many hands-on-keyboard intrusions and ransomware deployments. Detecting execution from a UNC admin-share path surfaces the pivot as it happens.

Malicious Volt Typhoon Port Proxy Configuration via Netsh (via process_creation)

This rule detects netsh being used to add an IPv4 to IPv4 port proxy rule, a living off the land relay technique Volt Typhoon uses to tunnel traffic through compromised network devices and hosts. This intrusion set targets critical infrastructure for stealthy lateral movement, so an interactive portproxy add almost always reflects adversary staged pivoting rather than administration.