Sigma detection rules, expert-reviewed

Suspicious Access To Chrome Credential Files

This rule detects read access to the Google Chrome Local State, Cookies and Login Data files by a process other than Chrome, captured via a SACL file audit and Security event 4663. In the WithSecure Windows Lab 4 tooling such as Chlonium or Mimikatz reads these files to steal the DPAPI master key and decrypt session cookies and stored passwords. Attackers harvest browser credentials and session tokens for account takeover.

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

This rule detects the ie4uinit LOLBIN being run with the -basesettings flag from a user-writable location such as AppData, the first-stage technique in the more_eggs TA4557 resume-lure intrusion where a copied ie4uinit loaded a malicious SCT through a planted ieuinit.inf. Adversaries relocate this signed binary to abuse its inf-driven command execution while evading path-based controls, so an out-of-System32 ie4uinit with -basesettings indicates staged code execution.

Malicious LSASS Memory Dump via comsvcs.dll MiniDump (via process_creation)

This rule detects credential theft where rundll32 invokes the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk, a technique observed in Akira ransomware intrusions. The resulting dump is later parsed offline to recover plaintext credentials and hashes.

Malicious Windows Defender Service Disable via sc.exe by Nova Ransomware

This rule detects sc.exe being used to disable the WinDefend service by setting its start type to disabled, a defense evasion step performed by Nova ransomware before encryption. Disabling the Defender service removes real-time protection from the host.

Suspicious Entra Device Code Authentication with Office Client and Automated User Agent

This rule detects Entra ID sign-ins using the device code authentication flow against the Microsoft Office client application from an automated python-requests user agent, matching the Kali365 device code phishing ecosystem. Adversaries phish device codes to obtain refresh tokens for the well-known Office client and replay them programmatically to access mailboxes. Device code flow paired with a scripted user agent is a strong indicator of token theft and mailbox compromise.

Coin Miner Masquerading as Misspelled svchost Process

This rule detects execution of processes named svhost.exe or svshost.exe, misspelled variants of the legitimate Windows svchost.exe. The GPU miner campaign ran its cryptomining payload under these typosquatted names to masquerade as a trusted system process. Any process using these near-identical names is almost certainly a masquerade attempt.

Malicious Shai-Hulud Data Exfiltration Script Execution via Process Creation

This rule detects execution of the .dev-env/config.sh helper script through bash, the staging and exfiltration routine dropped by the Shai-Hulud worm. The script bundles harvested secrets and pushes them to attacker infrastructure, so its execution indicates active collection and exfiltration on a compromised developer or build host.

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Malicious PAM Configuration Tampering for Passwordless su via pam_rootok (via process_creation)

This rule detects modification of a PAM configuration file to insert the pam_rootok module, granting passwordless su to root. This technique was reported in the Group-IB XMRig covert Linux PAM abuse campaign as a stealthy privilege and persistence mechanism. Abusing pam_rootok lets an attacker escalate to root without credentials while evading authentication logging, making it a high fidelity indicator of compromise.

Malicious Vulnerable Driver Load for BYOVD Defense Evasion (via image_load)

This rule detects loading of the rwdrv.sys, hlpdrv.sys and churchill_driver.sys kernel drivers abused in bring-your-own-vulnerable-driver attacks. Akira ransomware operators loaded these drivers to disable endpoint protection and tamper with security product access controls prior to encryption.

Possible Log4Shell JNDI Injection in HTTP Request

This rule detects JNDI lookup strings in HTTP request URIs or fields, indicative of Log4Shell (CVE-2021-44228) exploitation attempts against Log4j. Attackers embed jndi:ldap, jndi:rmi, or jndi:dns references, often inside headers such as X-Api-Version, to force the vulnerable logger to fetch and execute a remote class.

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

This rule detects deployment of the vulnerable drivers aswArPots.sys and IObitUnlockers.sys that GHOSTENGINE abuses to terminate endpoint security processes and delete their binaries. These bring-your-own-vulnerable-driver components provide kernel-level primitives to disable defenses. Their presence indicates an active attempt to blind security tooling.

Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE

This rule detects reconfiguration of the SessionEnv or IKEEXT services via sc config, a technique the EAGERBEE backdoor uses to load a malicious service DLL such as tsvipsrv.dll. These services are known targets for phantom-DLL loading under svchost. Modifying their binary path or service DLL indicates service hijacking for persistence.

Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy

This rule detects an IAM AttachUserPolicy call that attaches an administrator managed policy to a user, a technique used by operators of exposed IAM keys tracked by Unit 42 to escalate privileges before launching cryptojacking instances. Attackers abuse leaked long-term keys to grant themselves full control of the account which enables large scale resource abuse.

Malicious PowerShell In-Memory Download Cradle via IEX DownloadString

This rule detects PowerShell invoking IEX together with a Net.WebClient DownloadString call to fetch and execute code directly in memory. This tradecraft was used by APT41 to stage ShadowPad and Cobalt Strike against a Taiwanese government-affiliated research institute. In-memory download cradles let attackers run remote payloads without writing them to disk which frustrates file-based detection.