Sigma detection rules, expert-reviewed

Malicious Event Log Clearing via wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensic step used by The Gentlemen ransomware operators to erase traces. Clearing logs destroys the evidence needed to reconstruct intrusion activity. This is a strong defense-evasion indicator on servers and workstations.

Suspicious Kubernetes Secret and Permission Enumeration via kubectl (via process_creation)

This rule detects kubectl invocations that enumerate permissions or read secrets, matching reconnaissance from the Hell's Keychain supply-chain research on IBM Cloud Databases for PostgreSQL. Attackers list allowed actions and dump secrets to find credentials for lateral movement. Broad secret enumeration from an unexpected principal is a strong discovery indicator.

MSSQL Server Process Spawning Command Shell via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning cmd.exe or PowerShell, the direct signature of xp_cmdshell abuse on an exposed database server. Huntress observed operators chaining bcp data staging and local account creation from this shell during MSSQL intrusions. A database engine launching command interpreters is not normal behavior and indicates code execution through the SQL layer.

Malicious LSASS Credential Dump via SilentProcessExit WerFault Abuse

This rule detects registry modifications under the Image File Execution Options SilentProcessExit or GlobalFlag keys for lsass.exe, the mechanism that forces WerFault.exe to write a full memory dump of the process. Adversaries abuse this Windows Error Reporting behavior to dump LSASS and extract credentials without a recognized dumping tool. These keys targeting lsass.exe have no legitimate use.

Suspicious Winlogon Shell Persistence via Registry by Key Group

This rule detects modification of the Winlogon Shell value to something other than the default explorer.exe, a persistence technique used by Key Group ransomware to auto-run its payload at logon. Any non-default shell value on this key indicates hijacked user-session startup and should be investigated.

Suspicious Spectre Ops Staging in CullinetProgram Directory via file_event

This rule detects the Spectre Ops stealer staging files inside a CullinetProgram directory under AppData Roaming, which it pairs with a Startup folder entry for persistence. The uniquely named working directory holds the malware components between reboots. This distinctive folder name is not associated with legitimate software and reliably marks the stealer footprint on disk.

Suspicious Command in RunMRU Registry Indicating ClickFix Execution (via registry_set)

This rule detects a RunMRU registry entry containing a script interpreter or download command, a host artifact left when a victim pastes a ClickFix payload into the Windows Run dialog. The RunMRU key records the exact command executed through Win plus R.

Suspicious Autorun Registry Key Pointing to User-Writable Path (via registry_set)

This rule detects a write to a Run or RunOnce autostart key whose value references an executable located in a user-writable directory such as AppData, Temp, ProgramData or the Public folder. Malware commonly plants persistence in these keys so its dropper re-runs at logon while living outside trusted program paths. An autorun entry pointing into a staging directory is a classic persistence indicator.

Suspicious HTA Download via mshta and Curl in Process Creation

This rule detects mshta being used together with curl to fetch and execute a remote HTA payload, the ClickFix delivery chain attributed to Scarlet Goldfinch. Victims are socially engineered into pasting a command that downloads and runs the HTA, giving the attacker code execution through a signed Windows binary that bypasses application controls.

Suspicious Virtual Machine Detection via Registry Query (via process_creation)

This rule detects reg.exe querying the Virtual Machine Guest Parameters registry key used to fingerprint hypervisor or sandbox environments. This anti-analysis check was observed prior to Lynx ransomware deployment. Adversaries use it to decide whether to continue execution or evade automated analysis sandboxes.

Suspicious TruffleHog Secret Scanner Execution

This rule detects execution of the TruffleHog secret-scanning tool on developer or build hosts, where adversaries run it to harvest credentials and API keys from repositories and filesystems. It is associated with software supply chain attacks that repurpose legitimate developer utilities for credential theft. Detecting unexpected TruffleHog runs flags opportunistic secret collection.

Suspicious Text-File Payload Staging in Temp (via file_event)

This rule detects creation of specifically named text staging files used to hold base64-encoded .NET loaders and encrypted configuration. The SHADOW#REACTOR campaign used a text-only staging pipeline before in-memory Remcos RAT deployment.

Malicious XRed Backdoor Persistence via Synaptics Run Key (via registry_set)

This rule detects the XRed backdoor establishing persistence through a Run key value named Synaptics Pointing Device Driver that points into the ProgramData\Synaptics directory. The value name masquerades as a legitimate touchpad driver while the executable path is a non-standard ProgramData location dropped by trojanized InstantView installers. Attackers use this autorun entry to survive reboots and maintain backdoor access for keylogging and data theft.

Suspicious Mirage Kitten SspiCli.dll Search-Order Hijack via AppVShNotify.exe (via image_load)

This rule detects AppVShNotify.exe loading SspiCli.dll from outside System32, a DLL search-order hijack used by Mirage Kitten to execute malware under a trusted App-V binary against Middle East and Africa targets. Sideloading a system DLL name from an unexpected path lets the attacker run code stealthily while masquerading as a legitimate Windows component.

Malicious DLL Side-Loading of msimg32 via Silverlight.Configuration.exe

This rule detects Silverlight.Configuration.exe loading msimg32.dll from outside the Windows system directories. The Horns and Hooves campaign abused this signed binary to side-load a planted msimg32.dll and execute the NetSupport loader under a trusted process.