Sigma detection rules, expert-reviewed

Suspicious Data Staging into Archive via WinRAR

This rule detects the WinRAR command line utility archiving files with the exclude-base-path flag ep1 into a staging archive, a collection behavior observed in the ESXi intrusion prior to exfiltration. Attackers compress harvested data into a single archive to simplify transfer while stripping absolute paths. Command line rar with ep1 in server or unusual working directories can indicate archive-for-exfil staging.

Malicious Vulnerable Driver Mapping via KDU

This rule detects execution of the Kernel Driver Utility kdu.exe with its provider and driver-mapping flags, a bring-your-own-vulnerable-driver technique observed in the ESXi exploitation activity to load unsigned kernel code. KDU abuses a signed vulnerable driver to map an attacker driver such as MyDriver.sys into the kernel, defeating driver signature enforcement. Presence of kdu.exe with these arguments indicates kernel-level defense evasion.

Suspicious VMware PCI Device Disabled via Devcon

This rule detects devcon.exe being used to disable the VMware PCI device identified by hardware ID PCI\VEN_15AD&DEV_0740, a manipulation observed in in-the-wild ESXi VM escape activity. Disabling the VMCI or hypervisor-facing device weakens host isolation and supports the escape and defense-evasion chain. Legitimate use of devcon against VMware virtual hardware IDs is rare and warrants investigation.

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning whoami.exe, a webshell-driven reconnaissance behavior observed following exploitation of an internet-facing server. A web application context should never legitimately execute identity enumeration commands, so this parent-child relationship strongly indicates a deployed webshell running attacker commands. It typically marks the earliest hands-on-keyboard stage after initial access.

Suspicious File Hiding via Attrib System and Hidden Attributes

This rule detects attrib.exe applying the system and hidden attributes to an executable, a masquerading technique observed where the actor hid a malicious dllhost.exe from casual inspection. Marking a payload as a hidden system file conceals it from users and default directory listings. This behavior on user or public paths against an executable is a reliable low-noise indicator of hidden artifact staging.

Malicious Certutil URL Cache Download of Remote Payload

This rule detects certutil.exe being used with the urlcache and split flags to download a remote executable, a living-off-the-land technique used in the intrusion analyzed by Huntress to fetch agent.exe. Certutil is a certificate utility and its use to retrieve arbitrary files over HTTP is almost always malicious ingress tool transfer. Attackers rely on it to evade controls that block common download utilities.

Malicious PowerShell Download of conqueror.exe to Public Directory via Gladinet Exploitation

This rule detects PowerShell or curl downloading the second-stage payload conqueror.exe into C:\Users\Public during post-exploitation of the Gladinet CentreStack and Triofox vulnerability. The actors used Invoke-WebRequest and curl to stage the tool in a world-writable location for later execution. Retrieval of a named executable into a public path from a scripting host is a strong indicator of ingress tool transfer following server compromise.

Malicious mshta Spawning PowerShell Loader via ClickFix

This rule detects mshta.exe spawning PowerShell, the loader chain used by a ClickFix campaign that buries XOR-encoded shellcode in images before injecting into explorer.exe. The mshta stage decodes and launches PowerShell to deliver LummaC2 or Rhadamanthys stealers. mshta parenting PowerShell is a strong indicator of scripted malware execution.

Suspicious mshta Downloading Remote Payload via ClickFix

This rule detects mshta.exe invoked with a remote HTTP URL to download an archive payload, the initial execution stage of a ClickFix campaign hiding malware in images. Attackers trick users into pasting an mshta command that pulls a compressed loader from an attacker server. mshta reaching out to remote URLs is a well known living-off-the-land download technique.

Suspicious Remote MSI Installation from Amazon S3 via msiexec

This rule detects msiexec installing a package directly from an Amazon S3 URL, the delivery method observed during Velociraptor misuse where MsiInstaller events showed remote packages fetched from cloud storage. Remote MSI installation lets attackers deploy tooling without staging files locally. Interactive installs from arbitrary S3 URLs are rarely legitimate on production endpoints.

Suspicious Service Principal Name Discovery via setspn Query

This rule detects setspn being used with the query flag to enumerate service principal names, a Kerberoasting preparation step observed during Velociraptor misuse where the actor queried service accounts such as backup SPNs. Enumerating SPNs identifies service accounts whose tickets can be extracted and cracked offline. Command line SPN queries are uncommon outside administrative auditing.

Suspicious Velociraptor DFIR Agent Spawning Encoded PowerShell

This rule detects the Velociraptor DFIR agent spawning PowerShell with an encoded command, matching attacker misuse of Velociraptor running as LocalSystem to execute payloads following WSUS exploitation. Adversaries repurpose the legitimate incident response tool to run covert commands with high privilege. Velociraptor launching encoded PowerShell outside sanctioned hunts is anomalous.

Suspicious Rclone Cloud Exfiltration Execution

This rule detects Rclone being invoked to copy or synchronize data to a remote cloud target, the exfiltration tool used against educational organizations to bulk-transfer stolen files to attacker-controlled storage. Rclone flags such as remote copy and high transfer counts indicate mass data staging over web services. Unsanctioned Rclone usage on endpoints is a strong exfiltration indicator.

Malicious Masquerading Local Account WDAGUtilltyAccount Created via net user

This rule detects creation of a local account named WDAGUtilltyAccount, a deliberate misspelling of the built-in WDAGUtilityAccount, used by attackers against educational organizations to blend a persistence account into normal system accounts. The typosquatted name is designed to evade casual review of account listings. This masquerade is exclusively malicious and signals attacker persistence.

Suspicious AnyDesk Remote Access Tool Executed from ProgramData

This rule detects the AnyDesk remote access tool running from the C:\ProgramData directory, a deployment pattern used by threat actors targeting educational organizations to establish covert remote control as SYSTEM. Placing AnyDesk in ProgramData rather than its standard install path evades user notice. Unmanaged AnyDesk in this location indicates likely unauthorized remote access.