Sigma detection rules, expert-reviewed

Suspicious Proxyware Download to Hidden Tmp Path on Linux

This rule detects wget fetching a payload into the hidden /tmp/logs/.config/whatchdog location used to stage residential proxyware on compromised Linux hosts. Downloading an executable into a concealed tmp directory is a strong indicator of proxyware staging.

Suspicious Hidden PowerShell Download Cradle via IEX (via process_creation)

This rule detects a hidden-window PowerShell process using a download cradle and IEX to execute remote content in memory. Amatera Stealer ClickFix lures pasted this pattern to pull and run the next stage.

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

This rule detects the MSSQL server process sqlservr.exe spawning a command interpreter, indicating xp_cmdshell abuse for operating system command execution as seen in the printer-and-BitLocker extortion scheme. Attackers exploiting exposed MSSQL instances use this to run arbitrary commands and stage further tooling on the host.

RedDelta MSI Installation via Hidden PowerShell WindowsInstaller COM Object (via process_creation)

This rule detects the RedDelta delivery command that drives a hidden PowerShell process to instantiate the WindowsInstaller COM object and silently install a remote MSI with REMOVE=ALL. Adversaries leverage the scripted installer COM interface to fetch and run payloads while suppressing the installer UI, making this command pattern a strong execution indicator.

Suspicious Payload Download and Execution via curl chmod 777 (via process_creation)

This rule detects a download-and-run chain that fetches a file with curl or wget and marks it world-executable with chmod 777 before running it, the delivery routine used after exploiting the React Server Components flaws to stage XMRig, Mirai and Cobalt Strike CrossC2. Chaining retrieval, permission change and execution stages a remote binary on the compromised host.

Suspicious Mshta Autorun Persistence via Registry Set

This rule detects a Run key value pointing to mshta.exe, the registry persistence UAT-11795 plants to relaunch its Starland RAT loader at logon as reported by Cisco Talos. A HKCU Run entry that invokes mshta is highly atypical of legitimate software. Detecting it exposes autorun persistence tied to the script-based loader.

Suspicious Boto3 Kali Linux User Agent in AWS CloudTrail Reconnaissance (via cloudtrail)

This rule detects AWS CloudTrail activity from the specific Boto3 1.42.73 build running on Kali Linux that TeamPCP used to enumerate IAM EC2 Lambda and Secrets Manager resources after stealing credentials. The pairing of this SDK version with a Kali offensive distribution user agent is a strong indicator of hands-on-keyboard cloud reconnaissance with stolen keys.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious UpdatusUser Local Account Creation by Secret Blizzard

This rule detects creation of a local account named UpdatusUser via net user. Microsoft attributed this masquerading account name to Secret Blizzard establishing persistence during its AiTM campaign. The name mimics a legitimate updater service but is created interactively, so this specific account name is a high-confidence persistence indicator.

Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation

This rule detects PowerShell script content that disables the Antimalware Scan Interface by reflecting into System.Management.Automation.AmsiUtils and setting the amsiInitFailed field to true. This in-memory AMSI bypass was observed during React2Shell CVE-2025-55182 exploitation to blind endpoint scanning before executing follow-on payloads.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Caching

This rule detects the WDigest UseLogonCredential registry value being set to 1, forcing Windows to cache plaintext credentials in memory as documented by Huntress. Attackers enable this setting before dumping LSASS so that cleartext passwords are recoverable. This modification undermines credential protection and is a strong precursor to credential harvesting.

Suspicious AiTM Phishing Kit Session Validation Endpoint via Proxy

This rule detects web requests to reverse-proxy adversary-in-the-middle phishing kit endpoints, specifically the check_response handler carrying a session_id parameter alongside kit paths such as api/login, 2fa, sms and tap. It is associated with the Operation Fake KickOff campaign that abused recruiters and SaaS services to harvest corporate credentials and relay multi-factor authentication tokens. Detecting these structured kit paths surfaces live credential and MFA session theft.

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

This rule detects the VMware Tools guest process vmtoolsd.exe spawning a command interpreter such as cmd.exe or powershell.exe. Fire Ant abused hypervisor level access and CVE-2023-20867 to execute commands inside guest virtual machines from a compromised ESXi host, producing an unusual parent-child chain that does not occur during normal VMware Tools operation.

Malicious Local Administrator Added by Atera RMM Agent

This rule detects the AteraAgent process spawning net.exe to add an account to the local administrators group, an abuse chain Huntress observed during bulk attacks leveraging RMM tools against MSP-managed endpoints. Attackers who gain access to an RMM tenant push commands that create privileged accounts for persistence. Privileged account changes originating from an RMM agent are a strong indicator of tenant abuse.

Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)

This rule detects execution of an image whose name ends in a data-to-executable double extension such as .dat.exe, matching the STOCKSTAY chain where an HTA renamed a styles.dat payload to styles.dat.exe and ran it through WScript.Shell. Adversaries use double extensions to disguise executable payloads as inert data files, so running such a file is a strong masquerading indicator.