Sigma detection rules, expert-reviewed

Suspicious Creation of ctxsvc Local Account via net Command

This rule detects creation of a local user or group membership change for the ctxsvc account using net.exe, matching the persistence activity in the CitrixBleed 2 to DragonForce ransomware intrusion. Adversaries create a ctxsvc account masquerading as a Citrix service account and add it to privileged groups to maintain access. Creation of this account name is a persistence indicator on NetScaler-adjacent hosts.

Suspicious s5cmd Execution for Cloud Storage Exfiltration

This rule detects execution of s5cmd, a high-throughput S3 client, matching the data-exfiltration stage of the vibe-coded malware intrusion. Adversaries use s5cmd to rapidly upload staged files to attacker-controlled cloud storage. Presence of s5cmd on endpoints is rare in normal operations and suggests bulk exfiltration.

Suspicious PowerShell Execution of Untitled1 Script From ProgramData

This rule detects PowerShell executing a script named Untitled1.ps1 from the ProgramData directory, matching the vibe-coded Active Directory enumeration tool analyzed by Huntress. The default editor script name dropped into a world-writable path is used to run domain reconnaissance. Execution of this named script from ProgramData indicates hands-on-keyboard enumeration.

Suspicious Scheduled Task Creation With RMMProject Loader Task Names

This rule detects creation of scheduled tasks named msiInstall2 or ekShell2, matching the persistence mechanism of the Potemkin loader and RMMProject intrusion. Operators register these named tasks to relaunch loader and shell components across reboots. These specific task names are strong indicators of this campaign's persistence.

Suspicious mshta Execution Proxied Through pcalua LOLBIN

This rule detects the Program Compatibility Assistant (pcalua.exe) launching mshta.exe, matching the ClickFix execution chain of the Potemkin loader and RMMProject campaign. Adversaries abuse pcalua as a signed proxy to spawn mshta and run remote HTA or script payloads while evading parent-child heuristics. This chain initiates loader delivery and follow-on remote access tooling.

Suspicious Gammadyne Mailer Execution for Direct-to-MX Spam

This rule detects execution of the Gammadyne Mailer utility, matching the direct-to-MX spam blast run from a compromised terminal server in a phishing stager intrusion. Adversaries use this bulk mailer to send high volumes of outbound SMTP directly to recipient mail exchangers, bypassing corporate mail gateways. Its presence on a server is a strong indicator of abuse for mass phishing.

Suspicious Notepad Access to Active Directory Enumeration Output Files

This rule detects notepad.exe opening files named AdUsers.txt or AdComp.txt, matching hands-on-keyboard review of Active Directory enumeration output observed in Akira ransomware intrusions. Operators dump domain user and computer lists to text files and open them in Notepad while scoping the environment before encryption. This reconnaissance review precedes lateral movement and mass data destruction.

Malicious Scheduled Task Running svchost32 Proxy from Windows Temp

This rule detects schtasks creating a task that launches svchost32.exe from the Windows Temp directory, a masquerading socks proxy component observed in the Huntress-analyzed Gentlemen ransomware intrusion. The binary mimics the legitimate svchost name but runs from a non-standard path to establish proxied command-and-control. Creation of this task combines masquerading, persistence, and tunneling into a high-confidence indicator.

Suspicious Firewall Rule Added to Open RDP Port 3389 via netsh

This rule detects netsh adding an advanced firewall rule that opens local port 3389, the Remote Desktop port, observed in a Huntress analysis of exploited RDP misconfigurations. Attackers create this rule to expose RDP through the host firewall after enabling the service. A command-line firewall change opening 3389 during suspicious activity indicates preparation for remote interactive access.

Suspicious RDP Enablement via fDenyTSConnections Registry Modification [Huntress] #2

This rule detects reg.exe setting the fDenyTSConnections value to 0, which enables Remote Desktop connections on a host. It was observed in a Huntress analysis of repeatedly exploited RDP misconfigurations where attackers turned on RDP to establish interactive access. Enabling RDP from the command line during an intrusion facilitates lateral movement and hands-on-keyboard control.

Suspicious MSI Execution Disguised as Network Solutions Agreement

This rule detects msiexec executing a package named Network Solutions Agreement.msi, a social-engineering lure used in a Huntress-tracked malspam campaign to install Tiflux and stealthy RMM tooling. The filename impersonates a business document to trick users into running the installer. Execution of this specific deceptively named MSI indicates the initial malicious install stage.

Suspicious PowerShell Spawned by Komari Monitoring Agent

This rule detects the komari-agent binary spawning PowerShell, the built-in reverse shell behavior of the Komari monitoring tool abused in a Huntress-investigated intrusion. The agent was installed as a NSSM service masquerading as Windows Update Service and used its embedded shell for command execution. A monitoring agent launching an interactive interpreter reflects abuse of its reverse shell capability.

Malicious Remote Command Execution via smbexec Output Redirection Pattern

This rule detects the Impacket smbexec command pattern where cmd.exe runs a quiet echo redirected to an admin share output file, seen in a Huntress-investigated Komari intrusion for remote command execution over SMB. The tool wraps each command with %COMSPEC% /Q /c and writes results to a __output file on the target C$ share. This structural pattern is highly characteristic of smbexec-based lateral movement.

Suspicious Payload Retrieval via finger LOLBin

This rule detects execution of finger.exe, a living-off-the-land binary abused to retrieve remote payloads in a Huntress-observed ClickFix campaign delivering CastleLoader. The lure tricks users into pasting a clipboard command that uses finger.exe to pull attacker content. Because finger.exe is essentially unused on modern Windows, its execution is a strong indicator of malicious download activity.

Suspicious Privilege Discovery Spawned by M365 Copilot Process

This rule detects whoami executed with the /priv argument as a child of M365Copilot.exe, an anomalous parentage observed in a Huntress-investigated Nightmare-Eclipse intrusion where the actor masqueraded execution under a trusted application. The Copilot binary has no legitimate reason to spawn privilege enumeration. This parent-child relationship indicates process masquerading paired with hands-on-keyboard discovery.