Sigma detection rules, expert-reviewed

Deleting Windows Defender scheduled tasks

Detects the deletion of scheduled tasks related to Windows Defender.

Malicious Backup and Shadow Copy Destruction via Native Utilities

This rule detects the deletion of volume shadow copies, backup catalogs, and recovery configuration through native Windows utilities, a recovery-inhibition step performed by Hunters International affiliates before encryption. Destroying backups to prevent restoration is a hallmark of ransomware impact activity and should be treated as high priority.

Suspicious Process Execution from WinRAR Temporary Extraction Directory

This rule detects executables and batch scripts launching from the WinRAR temporary extraction path Temp\Rar$. The CVE-2023-38831 zero-day tricks users into running a spoofed-extension file that WinRAR extracts and executes from this directory. Such execution indicates archive-based exploitation and user-driven initial access.

Suspicious Finger Client Execution for Command and Control

This rule detects execution of the legacy finger.exe client, which adversaries abuse to reach external hosts and exfiltrate command output over the finger protocol. Huntress observed finger used to contact an attacker IP following OWASSRF exploitation of Exchange. Because finger is effectively obsolete on modern networks, any execution warrants investigation.

Suspicious Cgroup release_agent Abuse for Container Escape

This rule detects command activity referencing the cgroup release_agent and notify_on_release mechanism used to break out of a container and execute code on the host. Writing a release_agent path that runs on cgroup teardown is a classic privileged container escape. Detecting this reference exposes an attempted breakout to the underlying node.

Suspicious SAM Registry Hive Dump to Windows Temp by BianLian

This rule detects saving of the SAM registry hive into the Windows Temp directory, matching the credential access technique used by the BianLian ransomware group per Unit 42. Extracting the SAM hive lets the actor recover local account password hashes offline which supports lateral movement across the environment.

Suspicious Microsoft Defender Real-Time Protection Disabled via Registry

This rule detects registry modifications that disable Microsoft Defender real-time monitoring under the Windows Defender policy keys. Microsoft observed services.exe abused to disable Defender via registry during post-exploitation of SharePoint before deploying Warlock ransomware. Turning off antivirus through policy keys clears the way for credential theft and encryption, so this change warrants immediate review.

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

This rule detects PowerShell activity that extracts and decrypts stored credentials from a Veeam backup server database. Abyss Locker operators ran an obfuscated variant of a public Veeam credential dumping script to recover accounts for lateral movement before deploying ransomware. Legitimate use of such scripts against production backup servers is uncommon.

Malicious Cryptomining via AddInProcess Launching NEXA Miner (via process_creation)

This rule detects the .NET AddInProcess.exe binary executing with NEXA mining algorithm and pool arguments, the resource-hijacking payload dropped in this campaign to mine cryptocurrency on the victim host. Adversaries leverage AddInProcess as a signed proxy to run a bundled miner, making detection of the algorithm and pool flags a clear indicator of unauthorized mining.

Malicious Scheduled Task Creation Named ComboxResetTask

This rule detects the creation of a scheduled task named ComboxResetTask. HoneyMyte used this task name to persist its CoolClient tooling in recent campaigns as reported by Kaspersky. This specific task name combined with schtasks creation indicates malicious persistence.

Suspicious Atera Agent Installation via msiexec from PerfLogs Directory

This rule detects msiexec installing an MSI package staged in the C:\PerfLogs directory, observed in a Huntress-tracked intrusion where attackers deployed the Atera RMM agent from PerfLogs for persistence. PerfLogs is a non-standard software staging location and legitimate installers rarely run from it. Installation of remote management software from this path indicates attacker-driven persistence tooling.

Malicious Registry Run Key Persistence to ProgramData Batch File (via registry_set)

This rule detects a Registry Run key persistence entry whose value points to a batch file located under ProgramData, matching the MicrosoftUpdate run key that referenced a system.bat file in the compromised Axios NPM supply chain attack. Adversaries plant such entries under a benign-sounding name to survive reboot and relaunch their loader, so this pattern is a strong persistence indicator.

Suspicious Script Host Executing VBScript from System32 via Command Line

This rule detects wscript or cscript executing a VBScript located in the System32 directory, an anomaly Parallax RAT creates by staging a network reconnaissance script there and running it via a scheduled task. Legitimate user scripts rarely live in System32. Detecting the execution exposes discovery activity hiding in a system path.

Suspicious Registry Run Key Persistence for PlugX GDatas Payload (via registry_set)

This rule detects a Run key value that points to an executable inside the Users Public GDatas directory, the persistence mechanism used to relaunch the PlugX loader at logon. Legitimate autostart entries do not execute binaries from this public path.

Suspicious Data Exfiltration via Finger LOLBIN

This rule detects execution of finger.exe, a rarely used legacy binary abused as a living-off-the-land channel for data exfiltration and remote content retrieval. It was catalogued among data-exfiltration LOLBIN binaries. Any finger.exe execution in modern environments is anomalous and warrants review.