Sigma detection rules, expert-reviewed

Possible Targeted Kerberoasting via servicePrincipalName Modification

This rule detects addition of a servicePrincipalName value to a user account object. Adversaries with write access set an SPN on a target account to make it kerberoastable, then request a service ticket to crack the account password offline.

Suspicious Security Service Disable via SC Utility (via process_creation)

This rule detects the sc.exe service control utility being used to disable, stop or delete antivirus, EDR or event logging services. Ransomware intrusions abuse sc.exe to impair defenses so encryption and cleanup proceed unnoticed. Reconfiguring or removing protective services from the command line is a strong defense-evasion signal.

Suspicious RunOnce Persistence Pointing to ProgramData Payload

This rule detects RunOnce registry values that launch a payload stored under ProgramData, the persistence pattern Raspberry Robin used with a randomly named executable in a ProgramData subfolder. Autostart entries executing binaries from ProgramData are unusual for signed software and indicate malware persistence.

NetScan Share Enumeration Write Access Check

Detects the creation of unique artifacts created by SoftPerfect NetScan when performing write-access checking on enumerated network shares

PowerShell Loader Execution of Skype.ps1 from Public Folder (via process_creation)

This rule detects PowerShell executing a Skype.ps1 loader staged in the C users Public folder, the AsyncRAT delivery behavior observed in campaigns abusing ScreenConnect and open directories. Adversaries leverage the world-writable Public path to stage and run a fileless .NET loader while masquerading as a common application.

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

This rule detects a script or process accessing browser and cryptocurrency wallet credential stores for Chrome, Edge, MetaMask, Phantom and 1Password, matching the INVISIBLEFERRET JavaScript stealer that packages stolen data into a ZIP for exfiltration. This credential and wallet harvesting supports DPRK financial theft in the EtherHiding campaign.

Malicious ClickFix PowerShell Launching mshta with Remote URL (via process_creation)

This rule detects the ClickFix initial-access pattern where powershell.exe invokes mshta against a remote URL after a victim pastes a clipboard command through the Run dialog, as documented by Group-IB. Adversaries use this social-engineering chain to fetch and execute an HTA-based downloader, so the powershell-to-mshta URL pattern is a strong entry-point signal.

Malicious Webserver IIS Module Installed - PowerShell (via powershell)

This rule detects deploy an IIS module via PowerShell.

Malicious Replication Privileges Accessed to Perform DCSync Attack (via security)

This rule detects use DCSync or SecretDump tool to exfiltrate Active Directory credentials.

Suspicious Executable Persistence in Startup Folder (via file_event)

This rule detects an executable being written into the user Startup folder, the persistence method used by the VVS Discord stealer to relaunch itself at logon. Placing a binary under Start Menu Programs Startup guarantees the stealer re-executes on every user sign-in.

Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation

This rule detects the IIS worker process w3wp.exe spawning PowerShell with an encoded command argument, a behavior observed during active exploitation of the Gladinet CentreStack and Triofox insecure cryptography vulnerability where ViewState deserialization leads to code execution. Attackers abuse the hardcoded machineKey to forge ViewState payloads that execute PowerShell from the web application context. This chain indicates web-facing remote code execution and should be treated as a likely server compromise.

Suspicious cscript Execution of JavaScript Spawned by PowerShell

This rule detects powershell.exe spawning cscript.exe to run a JavaScript file, the ClickFix execution chain used by EddieStealer in which a pasted PowerShell command launches a downloaded .js loader. This parent-child relationship combined with script-host execution indicates fake-CAPTCHA social-engineering malware delivery.

PSEXEC Custom Named Service Binary

PSEXEC executed with non default service binary name

Malicious PlugX DLL Side-Loading via iviewers OLE Object Viewer (via image_load)

This rule detects the legitimate iviewers.exe OLE COM Object Viewer loading a co-located iviewers.dll from a non standard directory such as ProgramData. Velvet Ant abused DLL search order hijacking against this signed Windows SDK utility to load a PlugX loader and payload. Legitimate use of this tool loads its DLL from the SDK installation directory only.

Suspicious Wireless Credential Extraction via netsh wlan show profile in Katz Stealer (via process_creation)

This rule detects netsh.exe enumerating stored wireless profiles through the wlan show profile command, the WiFi credential extraction behavior performed by Katz Stealer during system profiling. Adversaries leverage netsh to recover saved network keys in clear text, making detection useful for identifying credential collection, though administrative troubleshooting can produce the same telemetry.