Sigma detection rules, expert-reviewed

Suspicious Shell or Installer Spawned by ActiveMQ Java Process

This rule detects a Java process spawning cmd, msiexec, or PowerShell, the exploitation chain of Apache ActiveMQ CVE-2023-46604 where the broker Java process executed attacker commands. A Java server process launching Windows shells or installers indicates remote code execution against the exposed service.

Suspicious File Download via certutil urlcache

This rule detects certutil downloading a remote file with the urlcache flag, used after WS_FTP exploitation to pull a payload into the Windows Temp directory. Certutil is a certificate utility and its use to fetch content over HTTP is a well known living-off-the-land ingress and proxy download technique.

Suspicious Local Account Creation Named DefaultService

This rule detects creation of a local account named DefaultService via net user /add, a masquerade used by the actor to blend a backdoor account with service naming conventions. New local accounts with deceptive service-like names during an intrusion indicate persistence and should be investigated immediately.

Suspicious Reconnaissance Spawned by wuauclt

This rule detects the Windows Update client wuauclt.exe spawning reconnaissance or shell child processes, an anomalous parent-child relationship seen in the Netscaler exploitation cases. The legitimate update client does not launch discovery utilities, so this pattern indicates process injection or masquerading followed by hands-on-keyboard recon.

Suspicious DLL Execution via rundll32 from PerfLogs Directory

This rule detects rundll32 loading a DLL from the C:\PerfLogs directory, observed in the Netscaler intrusion where the actor ran ch.dll,Start from PerfLogs. PerfLogs is not a normal location for executable DLLs, so rundll32 invocation against it strongly indicates proxied malicious code execution.

Suspicious Command Execution via ComSpec Environment Variable Obfuscation

This rule detects command lines that reference the delayed-expansion ComSpec variable using the exclamation syntax, an obfuscation Raspberry Robin uses when piping junk-laden files into cmd. Legitimate command lines almost never contain this token, making it a reliable indicator of obfuscated batch execution.

Suspicious Remote MSI Installation via msiexec from HTTP URL

This rule detects msiexec installing an MSI package directly from a remote HTTP URL, the core delivery behavior of Raspberry Robin USB malware. Fetching and installing a remote package through the signed msiexec binary is a proxy execution and ingress technique that legitimate installers rarely perform against arbitrary hosts.

Suspicious Remote HTA Execution via mshta from File Sharing Site

This rule detects mshta.exe fetching and executing a remote HTA file, including from the transfer.sh file sharing service as seen in this targeted phishing attack. Loading remote HTA payloads through the signed mshta binary is a proxy execution and defense evasion technique used here to stage an XWorm loader.

Suspicious Domain Admins Enumeration via Net Group

This rule detects enumeration of the Domain Admins group with net group, used by the INC Ransom group to map privileged accounts before privilege escalation. This is a frequent hands-on-keyboard discovery step during intrusions, though it can also appear in benign administration.

Suspicious jli.dll Sideloading by Non-Java Trusted Binary

This rule detects loading of jli.dll from a user-writable or temporary directory, the DLL sideloading vector observed in the Matanbuchus and AstarionRAT chain where a signed Java launcher was abused to load a malicious jli.dll. Placing an attacker DLL beside a trusted executable causes it to be loaded with the host binary's trust. Loading jli.dll from outside a legitimate Java runtime path indicates search-order hijacking.

Malicious DLL Sideload via SentinelBrowserNativeHost

This rule detects SentinelBrowserNativeHost.exe loading SentinelAgentCore.dll from a directory outside the legitimate SentinelOne installation path, indicating DLL sideloading used to run Cephalus ransomware loader code under a trusted signed binary. The rogue DLL pairs with a data.bin payload to decrypt and execute the ransomware. Abusing a security vendor binary for sideloading evades trust-based defenses.

Suspicious version.dll Sideloading via ADExplorer

This rule detects the Sysinternals ADExplorer binary loading a version.dll from outside the System32 directory, the DLL search order hijack the actor used to sideload malicious code. A trusted signed tool loading a non-system version.dll from its working directory is a classic sideloading pattern rather than normal execution.

Suspicious Hosts File Modification to Block Security Vendors via file_event

This rule detects writes to the Windows hosts file at drivers\etc\hosts. The Dragon Boss PUP edited this file to null-route antivirus and security vendor domains so protection tools could not update or communicate, so unexpected modification of the hosts file indicates an attempt to sever endpoint defenses.

Suspicious Application Config File Dropped Beside Trusted .NET Binary for App Domain Manager Injection

This rule detects creation of an application configuration file with the .exe.config extension in a user-writable location, the delivery step for App Domain Manager injection where the config redirects a trusted signed .NET binary to load an attacker assembly. The config declares an appDomainManagerAssembly that the runtime honors on startup, executing attacker code under the trusted process. A dropped .exe.config in a temporary or user directory beside a signed binary is a strong hijack indicator.

Suspicious Cleo Autorun Healthcheck File Creation

This rule detects creation of the healthcheck and healthchecktemplate autorun files that Cleo software processes to trigger command execution, the entry point abused in active exploitation of CVE-2024-55956. Attackers drop these files into the monitored autorun directory to run malicious payloads. Their creation on a Cleo host indicates an exploitation attempt against the file transfer service.