Sigma detection rules, expert-reviewed

Malicious PRT Token Forging via AADInternals (via ps_script)

This rule detects AADInternals cmdlets that mint or export Primary Refresh Token material and device certificates for cloud identity abuse. The cloud lateral-movement research shows attackers use these to forge tokens and access cloud resources as the victim. The cmdlet names are specific to this toolkit and indicate token theft or forgery.

Malicious Hidden PowerShell Execution From PerfLogs via Process Creation

This rule detects PowerShell launched with a hidden window that references an executable under the PerfLogs directory. The DroxiDat and SystemBC intrusion staged payloads such as hos.exe in C:\perflogs and executed them through hidden PowerShell, a technique used to run malware from an unusual location while suppressing any visible window.

Malicious Security Service Deletion via Sc

This rule detects sc.exe deleting Microsoft Defender and EDR related services such as Sense, WdFilter, or SgrmAgent, permanently removing protection components. This tampering is a hallmark of ransomware playbooks that disable endpoint defenses before impact. Deleting these services blinds detection and prevents recovery of protection without reinstallation.

Suspicious Scheduled Task Named ServiceHub.TestWindowStoreHost by Mustang Panda

This rule detects creation of a scheduled task named ServiceHub.TestWindowStoreHost, a persistence artifact associated with the TONESHELL variant used by Mustang Panda. The task name masquerades as a legitimate Visual Studio service component.

Possible VMware Workspace ONE SSRF via instanceHealth hostName At-Injection (via webserver)

This rule detects requests to the SAAS REST instanceHealth endpoint whose hostName or path parameters contain an at-sign injection redirecting the server-side request to an attacker host. This is the post-auth SSRF CVE-2021-22056 used to leak administrative JWT Authorization tokens from internal cluster instances. Detecting it surfaces token theft and internal request forgery against the vulnerable appliance.

Malicious VOLTZITE NTDS.dit Credential Staging in Temp Directory (via process_creation)

This rule detects command lines that reference the Active Directory database file ntds.dit together with copy or staging operations into temporary and world-writable directories. VOLTZITE stages ntds.dit in local and temp folders to extract domain credentials from compromised infrastructure. Access to the domain database enables offline password hash extraction and broad lateral movement.

Malicious Ransomware Self-Deletion via Ping Loopback and Del

This rule detects a command line that pings the unusual loopback address 127.0.0.7 and then deletes a file, a self-removal and timing-delay technique used by Mamona ransomware after encryption. The non-standard loopback octet combined with a delete command is a strong anti-forensic indicator.

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

This rule detects exiftool spawning setfile or a shell interpreter as a child process, the command injection sink exploited in CVE-2026-3102 when a crafted image reaches the SetMacOSTags system call. The injected command runs attacker controlled code on macOS during metadata processing. Detecting exiftool as the parent of these processes surfaces exploitation of the vulnerability.

Malicious Koi Loader C2 Check-in via Index PHP Beacon (via proxy)

This rule detects Koi Loader command-and-control beacons to an index.php endpoint carrying the campaign-specific subid=px8eIkut parameter used for host registration. This structured query pattern accompanies the pipe-delimited 101|GUID|VoYGkc5R check-in marker. Detecting it surfaces active Koi Loader C2 that precedes Koi Stealer deployment and credential exfiltration.

Malicious Payload Downloaded via PowerShell (via powershell)

This rule detects download a payload using PowerShell.

Malicious Boot Configuration Tampering via bcdedit (via process_creation)

This rule detects bcdedit commands that disable recovery options or manipulate boot configuration to support pre-OS persistence. DragonForce abuses bcdedit as part of a UEFI bootkit workflow and to inhibit Windows recovery, ensuring the compromise survives reboot and hampering remediation.

Possible NetHealth Implant C2 Beacon URI Pattern

This rule detects outbound HTTP requests matching the structured C2 beacon paths used by the Rapid Breach implant, including the resutato.com tap.php stager and the st.php beacon carrying computer and user name query parameters. These fixed URI patterns indicate command-and-control communication with the attacker infrastructure.

Suspicious TruffleHog Secret Scanner Spawned by Node Package Manager on Linux

This rule detects the TruffleHog secret scanning tool being launched as a child of a node or npm process which the Shai-Hulud npm worm abuses during package install to locate GitHub npm and cloud credentials on the victim host. Running a credential scanner from within a package install lifecycle is anomalous and indicates automated secret theft rather than a developer audit.

Malicious spinstall0.aspx Webshell Written to SharePoint Layouts

This rule detects creation of the spinstall0.aspx webshell within the SharePoint LAYOUTS directory, the payload dropped by ToolShell exploitation to harvest machine key material. An aspx file written into the SharePoint application layouts path is a strong indicator of webshell installation.

Malicious Follina MSDT Diagnostic Tool Code Execution (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool (msdt.exe) being invoked with Follina-style parameters such as PCWDiagnostic or IT_BrowseForFile, which the CVE-2022-30190 exploit uses to run attacker code from a weaponized document. MSDT abuse is a signed-binary code-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces document-driven exploitation before the payload executes.