Sigma detection rules, expert-reviewed

Malicious NTDS.dit Credential Extraction via ntdsutil

This rule detects ntdsutil being used to create a copy of the Active Directory NTDS.dit database, a credential dumping technique seen in Gootloader-enabled intrusions. Extracting NTDS.dit exposes every domain account hash for offline cracking and persistence. Interactive ntdsutil snapshots outside sanctioned maintenance are a strong compromise indicator.

Suspicious Windows Script Host Spawning PowerShell via Gootloader

This rule detects wscript.exe spawning PowerShell, the execution chain used by Gootloader after a user runs a malicious script delivered through SEO poisoning. The script host launches PowerShell to unpack and run the next stage in memory. Script host to PowerShell chains are uncommon in normal environments and warrant scrutiny.

Suspicious RMM Installer Executed from AppData Roaming Installer Directory

This rule detects msiexec installing an MSI from a user AppData Roaming Installer directory, matching the rogue ScreenConnect payload masquerading as LogmeinClient.msi in a Qilin ransomware intrusion. Attackers deploy remote monitoring tools from user-writable paths to maintain covert access. Legitimate RMM installs originate from download or system directories, not roaming profiles.

Malicious bcdedit Recovery Tampering Disabling Windows Boot Repair

This rule detects bcdedit disabling automatic recovery and forcing the system to ignore all boot failures, an inhibit-recovery technique used by the Crux ransomware operation. Turning off recovery and boot repair prevents the operating system from self-healing after encryption. This tampering is almost exclusively associated with ransomware impact preparation.

Suspicious Windows Defender Exclusion Added for Entire Windows Directory

This rule detects Add-MpPreference adding a Defender path exclusion for the broad C:\WINDOWS directory, an impairment technique used by the Nezha threat actor tool. Excluding the entire Windows directory blinds antivirus to malware staged in system paths. This overly broad exclusion is rarely legitimate and indicates deliberate defense evasion.

Malicious Web Server Spawning Command Shell and curl Download via Webshell

This rule detects an Apache httpd web server process spawning a command shell or curl download, matching AntSword webshell activity in the Nezha China-nexus intrusion set. The webserver context is abused to execute commands and pull additional tooling onto the host. Legitimate web servers do not launch interactive shells or file downloaders, making this a strong webshell indicator.

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

This rule detects ipconfig network reconnaissance whose output is redirected into a CentreStac_log.txt file under ProgramData, a marker observed after Gladinet CentreStack and Triofox exploitation. The attacker collects host network configuration and stages it to a staging file for later collection. The specific filename and redirect pattern make this a high confidence indicator of hands-on-keyboard activity.

Suspicious PowerShell Spawned by Web Browser

This rule detects PowerShell launched directly by a web browser process, an execution pattern seen when ClickFix lures drive victims to run pasted commands that establish Cloudflare tunnels or download payloads. This was observed across ClickFix variants. Browsers do not normally spawn PowerShell, so this parent-child relationship strongly indicates malicious execution.

Malicious ClickFix Execution via Headless Conhost

This rule detects a command shell or PowerShell spawned by conhost.exe running with the --headless flag, a ClickFix pattern that hides the console window while executing pasted attacker commands. This was observed across ClickFix variants delivering downloaders. A headless conhost parent for a shell is highly anomalous and indicates user-tricked code execution.

Suspicious Svchost Execution from Non-System Path

This rule detects a process named svchost.exe running from outside System32 or SysWOW64, indicating a renamed interpreter or masquerading binary rather than the genuine service host. In this campaign a renamed Python interpreter posing as svchost.exe executed a disguised image payload for PureRAT. Legitimate svchost always runs from the Windows system directories, so any other path is anomalous.

Malicious Azure AD Token Abuse via Roadtx

This rule detects execution of roadtx, a ROADtools utility used to request and manipulate Azure AD and Microsoft Graph tokens by impersonating first-party clients such as Microsoft Teams. Observed in a hands-on-keyboard operation, it enables token theft and cloud identity abuse against Entra ID. Roadtx on an endpoint indicates an actor pivoting to cloud identity compromise.

Malicious Scheduled Task Executing Binary from NETLOGON

This rule detects schtasks creating a task that runs a binary from the domain NETLOGON share, a persistence and distribution technique that stages ransomware on the domain controller for fleet-wide execution. This was observed during Obscura ransomware deployment. Tasks launching payloads from NETLOGON abuse domain replication to spread the encryptor to every host.

Malicious Shadow Copy Deletion via Vssadmin Quiet

This rule detects vssadmin deleting all shadow copies quietly, an inhibit-recovery action executed before encryption to prevent restore. This was observed during Obscura ransomware deployment. Silent removal of shadow copies denies victims local recovery and confirms destructive intent.

Suspicious Search-ms URI Handler Abuse to Remote Share

This rule detects command lines invoking the search-ms protocol handler with a remote location parameter, a technique that presents attacker-hosted SMB shares as local search results to trick users into launching malware disguised as documents. This was observed in a fake AnyDesk lure where an LNK masqueraded as a PDF. Search-ms abuse pointing to a remote share is a hallmark of social-engineered initial access.

Suspicious Collection Staging via Archive Utility Filters

This rule detects WinRAR or 7-Zip archiving with a password and document file-type filters, a collection and staging pattern that gathers sensitive files for exfiltration. This was catalogued among data-exfiltration TTP binaries. Password-protected archives scoped to office document types typically indicate deliberate data staging before theft.