Sigma detection rules, expert-reviewed

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

This rule detects the classic Linux netcat reverse shell built on a FIFO created with mknod, the interactive shell technique Red Canary covers in its detection engineer guide to Linux. Chaining a named pipe with netcat backconnects a shell to an attacker while avoiding the need for a netcat build that supports the exec flag.

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

This rule detects the SQL Server process spawning cmd.exe or powershell.exe, the xp_cmdshell execution that follows SQL injection against FortiClientEMS in the CVE-2023-48788 exploitation Red Canary reported. A database engine launching a command interpreter is a classic sign of xp_cmdshell abuse turning a SQL flaw into operating system code execution.

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Suspicious NetSupport Manager Client Executing From ProgramData via Process Creation (via process_creation)

This rule detects the NetSupport Manager client (client32.exe) running from the ProgramData directory, the remote access tool abused as a RAT in campaigns delivering malware through MSIX installers per Red Canary. Legitimate NetSupport deployments live under Program Files, so execution from ProgramData indicates an attacker-installed remote access foothold.

Suspicious Active Directory Export via Csvde via Process Creation (via process_creation)

This rule detects csvde.exe exporting directory data to a file, a bulk LDAP account-enumeration technique observed following MSIX malware delivery by Red Canary. Adversaries use csvde to dump the entire directory for reconnaissance and targeting, so its use outside routine administration warrants review.

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

This rule detects PowerShell adding Windows Defender exclusions or disabling real-time monitoring via Add-MpPreference or Set-MpPreference, a defense-evasion step used by malware delivered through MSIX installers per Red Canary. Attackers carve out exclusion paths so their staged payloads run unscanned, making unexpected exclusion changes a strong impairment-of-defenses signal.

Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)

This rule detects the MSIX StartingScriptWrapper.ps1 launching PowerShell from the WindowsApps directory, the installer-driven execution vector Red Canary tracked across multiple malware delivery campaigns. Legitimate apps rarely use this wrapper to run scripts, so its appearance signals a malicious MSIX package executing embedded PowerShell during installation.

Suspicious Domain Trust Discovery via Nltest via Process Creation (via process_creation)

This rule detects nltest.exe enumerating domain trust relationships, the domain reconnaissance SocGholish runs to map an environment per Red Canary. Adversaries use domain trust discovery to plan lateral movement across forests, and nltest /domain_trusts from a non-administrative context is a common early sign of that planning.

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects whoami /all discovery executed under a Windows script host parent, the reconnaissance SocGholish performs immediately after its malicious JavaScript runs as emulated by Red Canary. Script hosts collecting user and privilege context are a hallmark of the SocGholish fake-update loader beginning hands-off enumeration of a new victim.

Suspicious Local Administrator Account Creation via Net Command via Process Creation (via process_creation)

This rule detects the net command adding an account to the local Administrators group, a persistence step performed via cmd /c in the intrusion Red Canary analyzed alongside AnyDesk RMM deployment. While administrators occasionally do this, unexpected local admin creation following remote code execution is a strong sign an attacker is entrenching access.

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

This rule detects the Backup Exec Remote Agent (beremote.exe) spawning a command shell, bitsadmin, or PowerShell, the exploitation chain Red Canary traced from a vulnerable backup service into hands-on-keyboard activity. Backup agents should not launch interpreters or download utilities, so this parentage strongly indicates the service was abused for initial access.

Suspicious BITSAdmin File Transfer Into ProgramData via Process Creation (via process_creation)

This rule detects bitsadmin.exe performing a file transfer that writes into the ProgramData directory, the living-off-the-land download technique Red Canary observed where a remotely fetched 1.html was saved as 1.exe. Using BITS to stage payloads in a world-writable path evades some download monitoring, so this behavior warrants review of the downloaded file.

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

This rule detects WMIC being used to enumerate and delete Volume Shadow Copies, an inhibit-recovery step performed before encryption in the Confluence exploitation ransomware intrusion reported by Red Canary. Removing shadow copies prevents victims from restoring encrypted files, so this command is a strong precursor to imminent ransomware detonation.

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

This rule detects the Apache Tomcat process (which backs Confluence) spawning cmd.exe or powershell.exe, the post-exploitation behavior seen when adversaries exploited a Confluence vulnerability to deploy ransomware per Red Canary. A web application server launching a command interpreter almost always indicates successful remote code execution against the exposed service.