Sigma detection rules, expert-reviewed

Silent AnyDesk Remote Access Tool Installation

This rule detects AnyDesk executed with an install flag, indicating an unattended deployment of the remote access tool. Huntress observed adversaries installing AnyDesk on compromised MSSQL servers to maintain hands-on access. Silent RMM installation on servers is a common attacker persistence and command-and-control technique that blends with legitimate remote support tooling.

Suspicious BCP Data Staging to Public Music Directory

This rule detects the SQL Server bulk copy utility bcp.exe writing query output to the Public Music directory, a staging location used by operators who breached exposed MSSQL servers. Huntress observed this technique to drop payloads and stage data after xp_cmdshell abuse. Writing bcp query output to a world-writable public folder is a strong signal of post-exploitation tooling rather than administration.

Suspicious Remote MSI Install of Dokan Driver via msiexec

This rule detects msiexec installing a Dokan filesystem package, the driver this threat actor deployed to mount a virtual drive for credential and data staging. Dokan has legitimate uses in some software, so this pattern is a low-confidence signal best correlated with subsequent dokanctl mounting and LSASS access.

Suspicious Dokan Filesystem Driver Mount via dokanctl

This rule detects use of dokanctl to install or mount a Dokan user-mode filesystem, which this actor used to mount a virtual drive for staging an LSASS memory dump and collected data. The Dokan control utility is uncommon in enterprise environments and its use during an intrusion warrants investigation of the mounted volume.

Suspicious Data Exfiltration via finger to Remote Host

This rule detects execution of the legacy finger client against a remote host, abused in this case to exfiltrate directory and task listings and to pull down content over TCP port 79. The finger utility has virtually no legitimate use on modern Windows, so its execution against an external host indicates a living-off-the-land exfiltration or download channel.

Suspicious Event Log Clearing via PowerShell Invoke-Expression

This rule detects PowerShell clearing Windows event logs, used in the SysAid intrusion to remove traces of activity. Programmatic event log clearing is a strong indicator of anti-forensic defense evasion following a compromise.

Suspicious Security Product Enumeration via tasklist

This rule detects tasklist enumeration filtered for security product names such as Sophos, used after SysAid exploitation to check for endpoint defenses. Process discovery targeting security tooling is a common pre-attack step to plan defense evasion.

Suspicious PowerShell Spawned by SysAid Java Process

This rule detects the SysAid Java process spawning PowerShell, the exploitation behavior of CVE-2023-47246 where a WAR webshell led to PowerShell execution. The SysAid application server launching PowerShell indicates remote code execution through the vulnerable service.

Suspicious File Download via PowerShell WebClient DownloadFile

This rule detects PowerShell downloading files with WebClient DownloadFile, used to retrieve an MSI and a malicious MSBuild XML in this campaign. This is a common ingress tool transfer method that, while occasionally used by administrators, frequently indicates payload staging.

Suspicious Remote HTA Execution via mshta over HTTP

This rule detects mshta.exe executing a remote HTA over HTTP, used in this intrusion to reach an attacker command-and-control server. Remote HTA execution through the signed mshta binary is a proxy execution technique that legitimate applications do not require.

Suspicious Local XML Compilation via MSBuild

This rule detects MSBuild compiling a project from a non-standard file extension such as xml, used in this pharmaceutical vendor intrusion to run inline C# tasks. MSBuild processing a disguised project file is a trusted-developer-utility abuse technique for executing arbitrary code while evading application controls.

Suspicious Encoded PowerShell DownloadString Execution

This rule detects PowerShell using encoded command flags or an in-memory WebClient DownloadString with Invoke-Expression, the loader behavior in the Confluence CVE-2023-22518 to Cerber ransomware chain. Encoded and download-and-execute PowerShell is a common obfuscated fileless delivery method preceding ransomware deployment.

Suspicious Service Creation Masquerading as Windows Defender

This rule detects creation of a service named windowDefenSrv with sc create, a Defender-lookalike masquerade used for persistence after ActiveMQ exploitation. The deceptive Defender-like name combined with manual service creation is not expected from legitimate security software and signals attacker persistence.

Malicious Remote MSI Install of RuntimeBroker via msiexec

This rule detects msiexec installing a remote RuntimeBroker.msi package over HTTP, the payload delivery used after ActiveMQ exploitation. RuntimeBroker is a legitimate Windows name reused here to disguise a remotely fetched installer, combining masquerading with proxy execution and ingress tool transfer.

Suspicious Shell or Installer Spawned by ActiveMQ Java Process

This rule detects a Java process spawning cmd, msiexec, or PowerShell, the exploitation chain of Apache ActiveMQ CVE-2023-46604 where the broker Java process executed attacker commands. A Java server process launching Windows shells or installers indicates remote code execution against the exposed service.