Sigma detection rules, expert-reviewed

Suspicious Privilege Discovery Spawned by M365 Copilot Process

This rule detects whoami executed with the /priv argument as a child of M365Copilot.exe, an anomalous parentage observed in a Huntress-investigated Nightmare-Eclipse intrusion where the actor masqueraded execution under a trusted application. The Copilot binary has no legitimate reason to spawn privilege enumeration. This parent-child relationship indicates process masquerading paired with hands-on-keyboard discovery.

Malicious Defender Tampering via UnDefend Aggressive Flag

This rule detects execution of the UnDefend tool undef.exe with its -agressive flag, an EDR-tampering utility seen in a Huntress-investigated Nightmare-Eclipse intrusion that targeted the mpavbase.vdm Defender signature file. The distinctive misspelled flag identifies the specific tool used to disable endpoint protection. Disabling security controls precedes credential theft and lateral movement.

Suspicious Local Administrator Account Addition via net localgroup

This rule detects use of net or net1 to add an account to the local Administrators group, observed during a Huntress-tracked Bomgar exploitation campaign where attackers escalated privileges before ransomware deployment. Adding accounts to privileged groups from a command line is a common persistence and privilege-escalation technique. While administrators occasionally perform this manually, it should be corroborated with the initiating process context.

Malicious Command Shell Spawned by Bomgar Remote Support Client

This rule detects the Bomgar remote support client bomgar-scc.exe spawning a command interpreter such as cmd.exe or powershell.exe. It was observed in a Huntress-tracked uptick in Bomgar exploitation where the client spawned a SYSTEM shell used to add administrators and deploy ransomware. A remote support agent launching an interactive shell is a hallmark of post-exploitation abuse of the RMM tool.

Suspicious Credential Enumeration via cmdkey List

This rule detects execution of cmdkey with the /list argument, used to enumerate stored Windows credentials and RDP secrets. It was seen during post-VPN hands-on-keyboard activity in a Huntress-investigated intrusion where the actor enumerated saved credentials before lateral movement. Interactive credential store enumeration shortly after remote access is a strong indicator of an operator surveying the compromised host.

Suspicious Chrome Update Suppression via simulate-outdated-no-au Flag via process_creation

This rule detects Chrome launched with the simulate-outdated-no-au switch that suppresses browser auto-updates. The Dragon Boss Solutions PUP abused this flag to keep the browser in a vulnerable, non-updating state, so its presence on a command line indicates deliberate tampering with browser security posture.

Suspicious Data Staging via Everything and 7-Zip Prior to Exfiltration via process_creation

This rule detects the 7-Zip command line tool creating archives with recursive and password-protected options used to compress collected data for exfiltration. NightSpire operators used Everything to locate files and 7-Zip to stage them before uploading via MEGASync, so this archiving pattern indicates collection ahead of exfiltration and encryption.

Malicious Volume Shadow Copy Deletion via PowerShell Child Process via process_creation

This rule detects PowerShell spawning vssadmin, wmic, or WMI calls that delete volume shadow copies. NightSpire ransomware used a PowerShell child process to remove shadow copies and inhibit recovery before encryption, so this behavior is a high-confidence precursor to ransomware impact.

Suspicious Node Package Install Spawning Script Interpreters via process_creation

This rule detects node.exe spawning cscript, wscript, or powershell child processes. The compromised axios npm package ran a setup.js install script that chained into Windows script hosts and PowerShell to fetch and execute the next stage, so a Node process launching these interpreters indicates a malicious package post-install execution chain.

Suspicious Executable Execution from PerfLogs Directory via process_creation

This rule detects executables running from the C:\PerfLogs directory. INC ransomware operators staged and launched their win.exe encryptor from PerfLogs, a location that normally holds only performance trace data and no executables, so any process starting from this path is a strong indicator of malware staging.

Suspicious Scheduled Task Recovery Diagnostics Running PowerShell Script via process_creation

This rule detects schtasks.exe creating a scheduled task named Recovery Diagnostics that executes a new.ps1 script under the SYSTEM context. The threat actor used this task to run their PowerShell tooling with elevated privileges under a benign maintenance name, establishing persistence ahead of data exfiltration and ransomware deployment.

Suspicious Screensaver File Executed as Installer via process_creation

This rule detects a .scr screensaver file being executed directly as a program. In the rogue RMM campaign, invite and SSA themed lures were delivered as SCR installers to trick users into running the initial dropper, so execution of an .scr file outside of screensaver preview contexts indicates a masqueraded installer launching malicious payloads.

Suspicious RMM Uninstall Hiding via HideUL Execution via process_creation

This rule detects execution of HideUL.exe, a utility used to remove or hide entries from the Windows uninstall list. Rogue RMM operators run this tool to conceal their remote management software from Programs and Features so victims and defenders cannot easily find or remove the persistence, indicating deliberate defense evasion around an installed RMM tool.

Suspicious DLL Sideloading via FMAPP Executable from Non-Standard Path via process_creation

This rule detects the legitimate Realtek FMAPP.exe binary executing from a user-writable or non-standard directory rather than its normal program installation path. MuddyWater abused this signed binary to sideload a malicious FMAPP.dll, so execution from unusual locations such as AppData, Temp, or Public indicates a search-order hijack used to run attacker code under a trusted process.

Suspicious SSH Reverse Tunnel Execution via process_creation

This rule detects ssh.exe launched with the -N and -R flags used to establish a remote port forward without an interactive session. MuddyWater used this technique to open a reverse tunnel to attacker infrastructure, enabling persistent remote access and pivoting into the victim network while blending with legitimate SSH usage.