Sigma detection rules, expert-reviewed

Suspicious Outbound Request to Webhook.site Interaction Service

This rule detects curl.exe issuing a request to webhook.site, an out-of-band interaction service Huntress observed being used to confirm code execution and beacon after Wing FTP CVE-2025-47812 exploitation. Attackers rely on webhook.site to receive callbacks and stage small amounts of exfiltrated data over a trusted domain. Outbound requests to this service from a server process are a suspicious command-and-control indicator.

Malicious Kerberos Diamond Ticket Forgery via Rubeus

This rule detects execution of the Rubeus tool with diamond or ticket-request arguments used to forge Kerberos diamond tickets, a technique dissected by Huntress. Attackers decrypt a legitimate TGT and re-sign a modified PAC to impersonate privileged accounts while evading golden-ticket heuristics. Rubeus diamond ticket operations are a high-confidence credential-access and privilege-escalation indicator in Active Directory.

Suspicious Windows Service Installed with PHP-CLI ImagePath in MagicINFO Path

This rule detects Windows service creation where the ImagePath points to php-cli.exe under the MagicINFO tomcat directory, a persistence mechanism Huntress observed after exploitation of the Samsung MagicINFO 9 server. Attackers register a masqueraded service, often via srvany, to run a PHP interpreter and maintain execution. A service whose binary is a scripting interpreter in an application directory is a strong persistence indicator.

Malicious Registry Hive Theft from Shadow Copy via Print LOLBIN

This rule detects print.exe copying files from a volume shadow copy device path referencing GLOBALROOT, HarddiskVolumeShadowCopy, or a @GMT snapshot UNC path, a LOLBIN abuse technique documented by Huntress for stealing SAM and SYSTEM hives. Attackers use the print utility to read locked credential stores from a shadow copy without triggering hive-export tooling. This file-copy pattern via print.exe is highly anomalous and indicates credential-store theft.

Suspicious PowerShell Out-of-Band Request to Interactsh Domain

This rule detects PowerShell issuing a web request to Interactsh out-of-band domains such as oastify.com or oast.fun, used by attackers to confirm CVE-2025-30406 exploitation against Gladinet CentreStack as reported by Huntress. Adversaries trigger DNS or HTTP callbacks to validate code execution before deploying payloads. Outbound callbacks to out-of-band interaction services from PowerShell strongly indicate exploitation or reconnaissance.

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

This rule detects the IIS worker process w3wp.exe spawning powershell.exe, a web-shell style execution chain observed by Huntress during exploitation of Gladinet CentreStack and Triofox CVE-2025-30406. Attackers leverage a hardcoded machine key ViewState deserialization flaw to run commands as the web application. Because a web worker launching PowerShell is rarely legitimate, this chain is a high-confidence server compromise indicator.

Malicious Volume Shadow Copy Access via Mklink to GLOBALROOT

This rule detects creation of a symbolic link into a GLOBALROOT HarddiskVolumeShadowCopy device path, a technique Huntress observed for reading locked files such as SAM, SYSTEM, and NTDS.DIT from a volume shadow copy. Attackers use the shadow copy to bypass file locks and exfiltrate credential stores. Linking to a shadow copy device object is anomalous and indicates credential-store access.

Malicious NTDS.DIT Extraction via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media set to extract the Active Directory database NTDS.DIT, a domain credential theft technique described by Huntress. Attackers dump NTDS.DIT to obtain every domain account hash for offline cracking and lateral movement. IFM creation outside of planned domain controller promotion is a critical credential-access event.

Malicious Registry Hive Dump via Reg Save for Credential Theft

This rule detects reg.exe saving the SAM, SYSTEM, or SECURITY registry hives to disk, a technique detailed by Huntress for offline extraction of local account password hashes. Attackers export these hives to crack or pass local credentials without touching LSASS. Bulk hive export is rarely legitimate on production hosts and is a high-confidence credential-access indicator.

Suspicious RMM Tool Execution from Windows Temp Directory

This rule detects remote monitoring and management binaries such as AnyDesk, MeshAgent, or SimpleHelp executing from the Windows Temp directory, observed during CrushFTP intrusions by Huntress where RMM tools were silently installed for remote access. Attackers stage RMM agents in temporary directories to establish interactive control while masquerading as legitimate software. RMM execution from a non-standard path is a strong indicator of unauthorized remote access.

Suspicious Domain User Account Created via Net Command

This rule detects use of net.exe to create a new domain user account, observed during CrushFTP post-exploitation by Huntress where an account named vmadmin was added. Adversaries create backup credentials to persist and blend into normal administration. New account creation from interactive shells on servers is an important persistence indicator that should be correlated with the initiating process chain.

Suspicious Windows Defender Exclusion Added via PowerShell Add-MpPreference

This rule detects PowerShell using Add-MpPreference to register a Windows Defender exclusion, observed during post-exploitation of CrushFTP servers by Huntress. Attackers add path or process exclusions to prevent detection of tooling staged under directories such as Windows Temp. Disabling protection coverage before dropping payloads is a common defense-evasion precursor, so unexpected exclusion changes warrant review.

Suspicious Command Interpreter Spawned by Cleo Java Process

This rule detects the Cleo Java runtime spawning PowerShell or a command shell, the exploitation signature of active in-the-wild attacks against Cleo Harmony and related file transfer products under CVE-2024-55956. The vulnerable autorun mechanism executes attacker-supplied commands through the Java process. A Java service launching an interpreter indicates successful remote code execution on the server.

Suspicious Curl Download Spawned by PowerShell

This rule detects the curl client spawned as a child of PowerShell, an anomalous chain used to fetch second-stage tooling after an initial PowerShell foothold. Legitimate curl usage is rarely launched by an interactive PowerShell session. This process lineage indicates scripted download activity during post-exploitation.

Suspicious Download or Exfiltration via Finger LOLBin

This rule detects execution of the legacy finger client, an uncommon living-off-the-land binary that attackers repurpose to download payloads and exfiltrate data over the finger protocol. Its use in modern Windows environments is almost always malicious. Finger-based transfers move data across the network while blending with rarely inspected protocol traffic.