Sigma detection rules, expert-reviewed

Suspicious RDP Enablement via fDenyTSConnections Registry Modification

This rule detects modification of the fDenyTSConnections registry value to zero, which enables inbound Remote Desktop connections. Akira ransomware operators toggled this value to open RDP for lateral movement across victim hosts. Enabling RDP outside of change control frequently precedes hands-on lateral movement and ransomware staging.

Suspicious Run Key Persistence Under Masquerading Service Names

This rule detects registry Run key persistence created under the masquerading value names WdiServiceHost and ChromeUptodate, both used by an APT targeting Vietnamese human rights defenders to blend with legitimate services and Chrome updates. The names imitate trusted software while pointing to sideloaded implants. Run key persistence executes the payload at every user logon.

LanmanServer MaxMpxCt Registry Modification for Lateral Movement Preparation

This rule detects modification of the LanmanServer MaxMpxCt registry value, which raises the maximum outstanding SMB requests to support high-volume lateral spreading. Huntress observed BlackCat affiliates tuning this value before mass deployment across a network. This uncommon server parameter change is a preparation step for scaled lateral movement and ransomware distribution.

Malicious WDigest UseLogonCredential Enablement for Cleartext Credentials

This rule detects the WDigest UseLogonCredential value being set to 1, which forces Windows to keep cleartext credentials in memory for later theft. This registry modification was used in the pharmacy intrusion to enable plaintext credential harvesting and is almost never legitimate on modern systems.

Suspicious WMI Event Consumer Creation for MbRemoval Persistence via ps_script

This rule detects PowerShell content that registers a WMI event subscription tied to Win32_ProcessStartTrace with a consumer named MbRemoval. The Dragon Boss PUP used permanent WMI event consumers to react to process starts and remove security tooling, so creation of this MbRemoval consumer indicates stealthy WMI-based persistence and defense evasion.

Malicious Credential Stealer PowerShell Script Names Targeting Financial Services

This rule detects execution of PowerShell stealer scripts named for financial and cryptocurrency services such as secure.chase.ps1, qb_check.ps1 and coinbase_check.ps1 observed in the reviewed intrusions harvesting banking and wallet credentials. These distinctive script names encode the targeted brand and are stable indicators of the stealer tooling. Their appearance in command lines or script block logs indicates active credential access against financial accounts.

Suspicious Windows Defender Exclusion Added via Add-MpPreference

This rule detects use of Add-MpPreference to add Windows Defender path or extension exclusions, a defense-evasion step observed in the intrusion where the actor carved out exclusions before staging malware. Excluding a directory or file type from scanning lets subsequent payloads run undetected. While admins occasionally set exclusions, unexpected additions on endpoints frequently precede malware deployment.

Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent

This rule detects PowerShell using Get-WinEvent to harvest Terminal Services event ID 1149, which records successful RDP authentications, as seen in the r.ps1 script from a Qilin ransomware attack. Attackers mine these events to identify prior remote access sources and valid accounts for lateral movement. Bulk collection of RDP logon events is uncommon outside of forensic tooling.

Malicious Defender Exclusion Addition via Add-MpPreference

This rule detects Add-MpPreference adding Microsoft Defender path or extension exclusions, carving out blind spots where malware can run and write files unscanned. This was observed during Cephalus ransomware deployment. Attacker-created exclusions let the encryptor and staging artifacts evade real-time protection.

Malicious Defender Threat Action Override via Set-MpPreference

This rule detects Set-MpPreference configuring SevereThreatDefaultAction to Allow (6) so Microsoft Defender takes no action on severe detections. This weakens protection while leaving the AV appearing enabled, a subtle evasion used in enduring ransomware playbooks. Setting default threat actions to allow lets malware execute despite detection.

Malicious Volume Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell that enumerates Win32_Shadowcopy objects and pipes them to Remove-WmiObject to destroy volume shadow copies, an inhibit-recovery step preceding encryption. This behavior was observed in RMM-enabled intrusions leading to Akira ransomware. Removing shadow copies denies victims local recovery and signals imminent ransomware detonation.

PowerShell Local Account Creation With Self-Deleting Script

This rule detects a PowerShell script that creates a local user account and then removes itself from disk, a persistence-with-cleanup pattern observed during MSSQL server intrusions. Huntress recovered a user.ps1 that invoked New-LocalUser before deleting its own file. Combining account creation with self-deletion indicates covert backdoor account provisioning rather than routine administration.

Suspicious PowerShell Web Request to oastify Out-of-Band Domain

This rule detects PowerShell issuing a web request to an oastify.com domain, matching out-of-band interaction and tool retrieval observed after SQL injection compromise. The oastify.com domain is used for out-of-band application security testing callbacks and is abused by intruders to confirm code execution and pull payloads. PowerShell contacting this domain indicates active exploitation.

Suspicious Creation of ctxsvc Local Account via net Command

This rule detects creation of a local user or group membership change for the ctxsvc account using net.exe, matching the persistence activity in the CitrixBleed 2 to DragonForce ransomware intrusion. Adversaries create a ctxsvc account masquerading as a Citrix service account and add it to privileged groups to maintain access. Creation of this account name is a persistence indicator on NetScaler-adjacent hosts.

Suspicious s5cmd Execution for Cloud Storage Exfiltration

This rule detects execution of s5cmd, a high-throughput S3 client, matching the data-exfiltration stage of the vibe-coded malware intrusion. Adversaries use s5cmd to rapidly upload staged files to attacker-controlled cloud storage. Presence of s5cmd on endpoints is rare in normal operations and suggests bulk exfiltration.