Sigma detection rules, expert-reviewed

Malicious Azure Elevate Access to User Access Administrator

This rule detects the Microsoft.Authorization/elevateAccess/action operation, which assigns the calling Global Administrator the User Access Administrator role across all Azure subscriptions in the tenant. Adversaries who compromise a Global Administrator use elevateAccess to break out of Entra ID into the Azure resource plane and take control of every subscription. This is important because it is a high-impact privilege escalation that exposes all cloud resources.

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Suspicious Scheduled Task Named WindowsHelper (via process_creation)

This rule detects schtasks creating a task named WindowsHelper. Operation HumanitarianBait registers this masqueraded task to relaunch its VBScript stager every few minutes for persistence.

Malicious CMSTP UAC Bypass via INF File From Temp (via process_creation)

This rule detects cmstp.exe executing an INF configuration file from a Temp directory using the auto-install flag. This LNK-driven chain abuses CMSTP as a signed binary proxy to bypass UAC and run stealer payloads.

Suspicious Rogue Administrator Account Creation Named System32 (via process_creation)

This rule detects creation of a local account named System32 and its addition to the administrators group. The AgentTesla loader creates this masqueraded account to establish privileged persistence.

Malicious Windows Defender Service Tampering via PowerShell (via process_creation)

This rule detects PowerShell stopping or disabling the WinDefend service. The AgentTesla CPL loader chain uses these commands to neutralize Windows Defender before payload injection.

Suspicious OneNote Spawning Script Interpreter (via process_creation)

This rule detects OneNote spawning a command shell or scripting interpreter. BatLoader is delivered through malicious OneNote attachments that launch cmd or PowerShell to drop and run the BAT loader.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but whose image name is not powershell.exe or powershell_ise.exe. BatLoader copies powershell.exe to a temp folder under a decoy name such as Bill.bat.exe to evade image-based detection.

Suspicious Named Pipe ChromeDecryptIPC Used by Stealer (via pipe_created)

This rule detects creation of a named pipe containing ChromeDecryptIPC. Maranhao Stealer uses this pipe for reflective DLL communication when decrypting Chromium browser credentials.

Possible Ivanti Connect Secure Webshell Access

This rule detects HTTP access to Ivanti Connect Secure API paths and CGI scripts associated with the WIREFIRE, LIGHTWIRE, and backdoored compcheckresult webshells dropped during the zero-day exploitation. Attackers use these implanted webshells for persistent remote command execution on the appliance. Requests to these specific endpoints indicate an already-compromised device.

Malicious Run Key Persistence Referencing DLL in User Documents

This rule detects a Run key persistence value whose data references a DLL located under a user Documents folder, matching the Rhadamanthys stealer persistence that pointed an autorun entry at a DLL in the Documents directory. Autorun entries loading a DLL from a user-writable location strongly indicate malicious persistence rather than legitimate software.

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

This rule detects modification of the ServiceDll value for the IKEEXT or PrintNotify services, a DLL search-order and service hijack technique used by Winnti in Operation CuckooBees for persistence. Attackers point these built-in services at a malicious DLL so their code runs under a trusted service context. Tampering with the ServiceDll of these services is a strong persistence-and-evasion indicator.

PlugX Persistence via Run Key Named AAM Updatevlm

This rule detects creation of an autorun Run key value named AAM Updatevlm, a masquerading persistence value used by PlugX in DLL side-loading intrusions. The value name imitates a legitimate Adobe updater to blend in while re-launching the side-loaded malware at logon.

Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest

This rule detects the Exchange management cmdlet New-MailboxExportRequest writing a mailbox export to an .aspx file, the technique used in the DatopLoader ProxyShell chain to drop a web shell onto the Exchange server. Exporting mailbox data to a web-accessible ASPX path is a hallmark of ProxyShell post-exploitation and web shell staging.

Malicious Shell Spawned by SharePoint Worker Process w3wp

This rule detects the SharePoint worker process w3wp.exe spawning a command shell or PowerShell, the post-exploitation behavior following ToolShell webshell deployment. A web server worker launching interactive shells indicates webshell execution or exploitation of the hosting application.