Sigma detection rules, expert-reviewed

Suspicious Atera Agent Silent Onboarding via Process Creation

This rule detects the AteraAgent remote monitoring binary launched with init-settings and an embedded integrator or company key, a command line used to silently onboard a host into an attacker-controlled Atera tenant. Adversaries abuse legitimate RMM agents like Atera for persistent remote access and command execution, so unattended agent onboarding outside sanctioned IT deployment is a meaningful signal.

Suspicious Archive Extraction From AppData Staging Folder via Process Creation

This rule detects tar extracting an archive from a numeric AppData Local staging folder, the unpacking step in the Scarlet Goldfinch ClickFix chain that stages the next payload. Adversaries create a short randomly named numeric directory under AppData and expand a downloaded archive there before execution, so tar activity in this location signals payload staging.

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

This rule detects curl or wget command lines that reference the AWS credentials file, the exfiltration step used by malicious OpenClaw agent skills to steal cloud keys. Adversaries read the .aws/credentials file and post it to attacker infrastructure, so a web client touching this path indicates active credential access and exfiltration.

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

This rule detects the Bun JavaScript runtime spawning the TruffleHog secret scanner, a behavior chain used by the Shai-Hulud worm to harvest credentials from developer and CI environments. Adversaries abuse the legitimate TruffleHog tool during package install hooks to locate secrets before exfiltrating them, so this parent-child pairing is a strong indicator of automated credential collection.

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

This rule detects registration of a rogue self-hosted GitHub Actions runner using the runner.listener binary with unattended flags and the SHA1HULUD name marker tied to the second-wave Shai-Hulud supply chain worm. Attackers register malicious runners to obtain persistent code execution inside CI/CD pipelines and spread across repositories, enabling mass credential theft and downstream package poisoning.

Malicious Hidden Virtual Machine Launched via QEMU for Persistence

This rule detects QEMU started with a qcow2 disk image and a user mode network device which adversaries use to run a concealed virtual machine on the host to evade endpoint detection and maintain persistence. Running malicious tooling such as Sliver inside an attacker supplied VM hides its activity from host based sensors. Detecting these QEMU arguments surfaces the bring your own virtual machine technique.

Suspicious ScreenConnect Remote Access Binary Running Under a Renamed Executable

This rule detects a process whose original filename identifies it as ScreenConnect or SimpleHelp remote access software but whose on disk name has been changed which indicates masquerading to evade detection during phishing driven RMM abuse. Renaming remote support tools helps adversaries hide interactive access from defenders. Detecting the mismatch surfaces disguised remote access tooling.

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

This rule detects AteraAgent executed with IntegratorLogin and CompanyId parameters which perform a silent unattended enrollment of the Atera remote monitoring agent. Adversaries in phishing campaigns delivering RMM tools use these switches to covertly onboard victim hosts into an attacker controlled Atera tenant. Detecting this command line surfaces unauthorized remote access tool deployment.

Suspicious node.exe Execution Spawned by PowerShell

This rule detects the Node.js runtime being launched by PowerShell which is the loader behavior of the Mocha Manakin NodeInitRAT backdoor. Delivering a backdoor through node.exe lets adversaries run a full featured JavaScript implant while masquerading as a legitimate developer tool. Detecting node spawned from PowerShell surfaces execution of the custom backdoor.

Possible Remote Monitoring and Management Tool Abuse for Remote Access

This rule detects execution of remote monitoring and management tools including AnyDesk TeamViewer and NetSupport client32 that adversaries such as Storm-1811 abuse to gain hands on keyboard access after social engineering. These tools are legitimate but are frequently deployed by intruders to maintain interactive control of victim hosts. Detecting their execution supports baselining and hunting for unsanctioned remote access.

Suspicious Batch Script Execution Spawned by wscript via VBScript

This rule detects cmd running a batch file that was launched by wscript executing a VBScript which is the delivery chain used by the Tangerine Turkey cryptomining worm spreading through removable media. The worm uses a VBScript on a USB drive to invoke a batch script that stages XMRig. Detecting this parent-child chain surfaces user execution and worm propagation before the miner deploys.

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

This rule detects chrome.exe or msedge.exe launched with a remote debugging port together with a profile directory argument, the app-bound encryption bypass Red Canary observed across Stealc, Vidar, Cryptbot, Remcos, and Lumma stealers. Attackers drive a headless debugging session to read decrypted cookies from a live browser profile, so this argument combination indicates credential and session theft.

Suspicious Browser Launch with Unpacked Extension Loaded via load-extension (via process_creation)

This rule detects chrome.exe or msedge.exe launched with the --load-extension argument, the browser-hijacking persistence Red Canary observed for sideloading an unpacked extension without user interaction. Adversaries use this flag to inject a malicious extension for credential and session theft, so its use outside developer workflows warrants review.

Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)

This rule detects the NW.js runtime nw.exe executing from the AppData Roaming directory, the Charcoal Stork behavior Red Canary documented for delivering Yellow Cockatoo and related payloads. Legitimate NW.js applications install under Program Files, so execution from a user roaming profile indicates a bundled malicious NW.js package.

Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)

This rule detects mshta.exe spawning powershell.exe, the FakeSG execution chain Red Canary highlighted where a malicious HTA launches PowerShell to continue the infection. The HTML Application host launching PowerShell is uncommon in legitimate activity, so this parent-child pairing indicates script-based execution through a living-off-the-land binary.