Sigma detection rules, expert-reviewed

Suspicious Entra Agent Service Principal Sign-In With PowerShell User Agent via Sign-In Logs

This rule detects a service principal sign-in using a PowerShell user agent against Entra Agent ID identities, a pattern of automated credential misuse where an attacker authenticates as an AI agent through scripted Graph calls. Because assigned agents normally authenticate through their own runtime rather than interactive PowerShell tooling, this user agent on service principal sign-ins indicates hands-on-keyboard abuse of agent credentials.

Suspicious Script Execution from Public User Folder Staging Directory

This rule detects wscript, cscript, or PowerShell executing a .js or .ps1 file staged under C:\Users\Public, a staging location used in a Huntress-analyzed malspam-to-loader chain to hide script components. The Public folder is world-writable and rarely a legitimate home for scripts. Interpreter execution of scripts from this path is a strong indicator of loader staging activity.

Malicious Hidden Logon Scheduled Task RuntimeOptimizeService via TCLBANKER

This rule detects creation of a scheduled task named RuntimeOptimizeService with a logon trigger and hidden attribute as used by the TCLBANKER banking trojan for persistence in Elastic research. The service like task name combined with a hidden logon trigger indicates a masqueraded persistence mechanism for the implant.

Malicious Cloud Atlas PowerShell Download Cradle via IEX WebClient (via process_creation)

This rule detects PowerShell combining Invoke-Expression with a Net.WebClient object to fetch and execute remote content, the download cradle used by Cloud Atlas to run its next stage in memory. The technique avoids writing the payload to disk before execution. Detecting the IEX and WebClient combination surfaces staged payload execution.

Malicious Lateral Movement via Impacket WMIExec Command Pattern

This rule detects the Impacket wmiexec command pattern where cmd.exe runs with /Q /c and redirects output to a loopback ADMIN$ share, observed by Huntress during a targeted intrusion at a marketing research firm. Attackers use this pattern for semi-interactive remote command execution over WMI while capturing output through SMB. The loopback ADMIN$ output redirection is a distinctive signature of Impacket-style lateral movement.

Possible SonicWall Credential Testing via userLogin Endpoint

This rule detects HTTP POST requests to the SonicWall /cgi-bin/userLogin endpoint, the interface used by NetExtender and web login for credential submission. In the observed campaign this endpoint is hit through commercial proxy infrastructure to test credentials against internet-facing SonicWall firewalls. A high rate of such POST requests indicates brute-force or credential-stuffing activity against the SSL-VPN login surface.

Suspicious Entra ID Auth Broker Sign-In With Node.js User Agent via Tycoon 2FA

This rule detects Entra ID sign ins against the Microsoft Authentication Broker application from Node.js based clients such as axios undici and node-fetch as characteristic of Tycoon 2FA adversary in the middle attacks in Elastic research. Automated Node runtimes replaying stolen tokens through the Auth Broker indicate token theft and primary refresh token abuse rather than genuine user interaction.

PlugX DLL Sideloading via mcoemcpy.exe Loading McUtil.dll (via image_load)

This rule detects the legitimate McAfee binary mcoemcpy.exe loading a malicious McUtil.dll, the DLL side-loading behavior used to launch the PlugX backdoor in the NailaoLocker intrusions across Europe. Adversaries abuse a trusted signed executable to run the PlugX loader under a benign process while evading endpoint controls.

Suspicious Modification of rc.local Startup Script by Knife Framework

This rule detects modification of the rc.local startup script on Linux systems. The Knife framework inserts persistence markers into rc.local so its implants relaunch at boot on compromised edge devices. Unexpected changes to rc.local are a common Linux persistence indicator.

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Renamed DLL Sideloading via Renamed Greenshot Loading GreenshotPlugin from AppData (via image_load)

This rule detects a masqueraded FortiClientCompliance.exe, which is a renamed signed Greenshot binary, sideloading GreenshotPlugin.dll from a user-writable FortiClient compliance directory. Adversaries abuse this signed executable to load an attacker-controlled plugin DLL that in turn decrypts and runs shellcode, making early detection critical for surfacing the loader before command-and-control is established.

Masquerading Execution of Binary from Var Log Directory (via process_creation)

This rule detects execution of an executable located under the var log directory on Linux, the persistence staging behavior of the Kimsuky Gomir variant which copies its binary to var log rsyslogd and runs it through a systemd service. Adversaries leverage a log directory that normally holds only text logs to hide an executable while masquerading as the rsyslog daemon, making early detection critical for surfacing the implant before it beacons.

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

This rule detects web requests to the shell and file API endpoints used by the CurKeep backdoor for command-and-control in the Stayin Alive campaign. The fixed api shell and api file URI paths reflect the backdoor tasking channel and help surface implant traffic in proxy logs.

Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)

This rule detects a PowerShell binary renamed to wt.exe and executed from ProgramData, a masquerading technique used by the malicious postinstall payload delivered through the compromised Axios npm package. Adversaries rename PowerShell to evade name-based detection while running follow-on scripts, so a PowerShell OriginalFileName under a wt.exe in ProgramData is a strong indicator of the supply chain implant.

Suspicious WScript Spawning PowerShell From VBS Loader via wscript.exe (via process_creation)

This rule detects wscript.exe launching powershell.exe, a script host chain used by the Kimsuky campaign against Japanese organizations where a malicious VBS decoded and executed PowerShell payloads. Attackers rely on this living-off-the-land chain to stage keylogging and infostealer functionality while evading direct execution of binaries.