Sigma detection rules, expert-reviewed

Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly and invoking a method named VAI. This layered loader uses this in-memory technique to execute payloads decoded from steganographic images.

Suspicious Kimsuky JS Downloader Staging in Public and Templates Paths (via file_event)

This rule detects the creation of Kimsuky downloader and launcher scripts such as DefenderUpdate.js in Public Downloads or Templates.js and Templates.ps1 in the Windows Templates directory. These filenames and locations are used by the PebbleDash infection chain to stage follow on payloads.

Suspicious IIS Worker Process Spawning Command Shell via Web Shell (via process_creation)

This rule detects the IIS worker process spawning a command interpreter or WMI utility, a behavior consistent with the Phantom Taurus web shell loading IIServerCore inside w3wp.exe. Server-side web shells use the worker process to execute reconnaissance and lateral movement commands. Detecting this chain surfaces active exploitation of a public-facing web application by a Chinese-nexus APT.

Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)

This rule detects compromise a server with high privileges to perform permissions changes. PrivExchange attack can be detected using this rule.

Malicious Akira Ransomware Encryptor Command Line Flags

This rule detects execution of a binary using the stopvm and vmonly flags characteristic of the Akira Rust ransomware encryptor targeting ESXi. These flags instruct the tool to shut down and encrypt only virtual machines. Detecting the flag combination exposes the ransomware payload at runtime.

Suspicious Modification of SSH Authorized Keys on SD-WAN Appliance by UAT-8616

This rule detects changes to the root SSH authorized_keys file on Cisco Catalyst SD-WAN appliances. UAT-8616 adds attacker-controlled SSH keys and enables root login to persist after exploiting vManage. Injecting authorized keys grants durable passwordless root access to the compromised device.

Suspicious Cron Persistence Installing a Downloader via Command Line

This rule detects a crontab entry being registered that embeds a curl or wget download command, indicating a scheduled task that re-fetches attacker code on a recurring basis. The OpenClaw supply chain campaign uses cron jobs for command-and-control persistence on macOS and Linux hosts. Flagging this uncovers a recurring foothold that survives reboots and re-establishes contact with the attacker.

Suspicious Inbox Rule Moving Mail to Junk for Concealment (via m365)

This rule detects creation or modification of a mailbox inbox rule that moves incoming messages to the junk email folder. Threat actors created such rules to hide fraud notifications and security alerts from the victim while automating financially driven attacks.

StealC Loader Execution via Blender Spawning Script Interpreter (via process_creation)

This rule detects blender.exe spawning a command shell or script interpreter such as PowerShell, cmd, or python, the execution behavior triggered when a malicious .blend file with embedded auto-run Python fetches a remote loader in the StealC V2 Blender campaign. Adversaries leverage the Blender Auto Run Python Scripts setting so opening a downloaded model executes their loader, making early detection critical for stopping the chain before the StealC stealer and Pyramid C2 module deploy.

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

This rule detects enumerate potential existing users, resulting in failed Kerberos TGT requests with unexisting or invalid accounts.

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

This rule detects modification of Session Manager execution values such as BootExecute, SetupExecute, PlatformExecute and S0InitialCommand under the Control key. These values run native applications very early during boot and are abused by adversaries for stealthy persistence and defense evasion.

Suspicious icacls Grant of Full Control to Everyone

This rule detects icacls granting the Everyone security principal full control, the permissive access change The Gentlemen ransomware applied to ease propagation and encryption. Granting the Everyone group full control over files is rarely legitimate and typically supports lateral movement or mass file access.

Malicious Defender Exclusion for Fake DefenderUpdates Folder via Add-MpPreference (via process_creation)

This rule detects Add-MpPreference adding a scanning exclusion for the DefenderUpdates folder under the roaming profile, the staging directory into which Salat Stealer drops its docconv.exe payload. Adversaries leverage a Defender exclusion path that mimics a legitimate update folder so the dropped executable can run unscanned, making early detection critical for catching persistence before data theft.

Masquerading Bumblebee Loader MSI Download via PowerShell Invoke-WebRequest and Silent msiexec (via process_creation)

This rule detects a single PowerShell command that uses Invoke-WebRequest to download an MSI installer and then launches msiexec silently, the delivery behavior used by an LNK-triggered Bumblebee loader infection chain masquerading as Nvidia and Midjourney installers. Chaining a remote MSI fetch with a quiet install in one command line is a strong indicator of staged loader delivery before in-memory payload execution.

Suspicious Self-Copied CMD Script in ProgramData (via file_event)

This rule detects creation of a command script named rEgX.cmd within the ProgramData directory. The Dead#Vax campaign copied itself to this file as part of its persistence and self-healing routine.