Sigma detection rules, expert-reviewed

Suspicious ClickLock LaunchAgent Persistence Plist Creation (via file_event)

This rule detects creation of the com.authirity or com.chromer LaunchAgent property lists that ClickLock macOS stealer drops for RunAtLoad persistence. The misspelled and lookalike labels masquerade as legitimate system or browser agents while ensuring the stealer relaunches. Detecting these plists exposes ClickLock persistence.

Malicious RansomHub Ransom Note Creation via README Random Suffix Pattern (via file_event)

This rule detects creation of RansomHub ransom note files following the README_ prefix with a random six-character suffix documented by Group-IB. Adversaries drop these notes across encrypted directories to signal impact and deliver extortion demands, so their appearance indicates active ransomware encryption.

Suspicious DarkMe Cabinet.ocx Payload Dropped in AppData WinSoft Directory

This rule detects the DarkMe payload Cabinet.ocx being written to the APPDATA WinSoft directory during WinRAR CVE-2023-38831 exploitation. The dropped OCX component is registered and loaded to establish persistence. Its distinctive path indicates a compromised host in this campaign.

Malicious VietCredCare Credential Exfiltration Staging Files

This rule detects staging files created by the VietCredCare stealer using its distinctive COMPUTERNAME--COOKIES-.txt and --PASS-.txt naming pattern. These files hold stolen browser cookies and passwords prior to exfiltration to a Telegram channel. Their presence indicates active credential harvesting on the host.

Malicious DeadBolt Persistence via QNAP Update Package Overwrite

This rule detects modification of the SDDPd.bin file inside the QNAP update package directory which DeadBolt ransomware overwrites to persist and control the device boot sequence. Hijacking this autostart component keeps the ransom logic resident across reboots. It matters because it embeds attacker control deep in the appliance firmware path.

Malicious Vulnerable Driver Load via TfSysMon.sys BYOVD (via driver_load)

This rule detects loading of the TfSysMon.sys vulnerable driver abused by the RansomHub Killer tool to disable security products through bring-your-own-vulnerable-driver as reported by Group-IB. Adversaries load this signed but vulnerable driver to terminate AV and EDR processes from kernel space, making its load a strong defense-evasion indicator.

Suspicious SonicWall Access With Anomalous Chrome Linux User Agent via Webserver

This rule detects requests to SonicWall SSL-VPN and login endpoints that carry an automated-tool signature combining a Chrome 119 on Linux user agent with the campaign target paths. The reconnaissance campaign against SonicWall firewalls presents this consistent Chrome Linux user agent while probing management endpoints from commercial proxy infrastructure. Correlating the anomalous user agent with SonicWall endpoints surfaces scripted scanning that generic path-only detection may miss.

Suspicious SonicWall SSL-VPN Reconnaissance Endpoints via Webserver

This rule detects HTTP requests to SonicWall SSL-VPN and management endpoints characteristic of automated reconnaissance, including /api/sonicos/is-sslvpn-enabled and /sonicui/7/login/. An active campaign delivered through commercial proxy infrastructure enumerates these endpoints to identify exploitable SonicWall firewalls before attempting credential attacks or exploitation. Detecting this enumeration lets defenders identify and block scanning infrastructure early.

Suspicious BeyondTrust Remote Support Probing of nw Endpoint via Webserver

This rule detects HTTP or WebSocket requests to the /nw endpoint on BeyondTrust Remote Support or Privileged Remote Access appliances, which is the reconnaissance and exploitation surface for CVE-2026-1731. Threat actors probe this endpoint to fingerprint and attack internet-facing BeyondTrust deployments prior to remote code execution. Early detection of this probing lets defenders block scanning infrastructure before exploitation succeeds.

Possible Ivanti EPMM In-Memory Java Webshell Access via mifs 403.jsp

This rule detects inbound requests to the /mifs/403.jsp path on Ivanti Endpoint Manager Mobile, the location of an in-memory Java webshell planted during active exploitation. Access to this path indicates post-exploitation command-and-control against EPMM appliances traced to a single bulletproof-hosted IP.

Possible FortiWeb Path-Traversal Authentication Bypass Exploitation CVE-2025-64446

This rule detects inbound POST requests containing a path-traversal sequence that reaches the FortiWeb fwbcgi CGI endpoint through the cmdb admin API, matching the authentication-bypass exploitation of CVE-2025-64446 observed in the wild. Successful exploitation lets an unauthenticated attacker create administrative accounts and run privileged commands on the appliance.

Suspicious Access to Spring Boot Actuator Heapdump Endpoint

This rule detects inbound HTTP requests to the Spring Boot Actuator /heapdump endpoint, which exposes a full JVM memory dump that can leak passwords and secrets. Threat actors abused this against the TeleMessage SGNL Signal-based messaging clone via CVE-2025-48927 during active reconnaissance and exploitation. Successful access lets attackers harvest credentials directly from process memory.

Suspicious Bash Dev-TCP Reverse Shell Execution

This rule detects Linux shell invocations that open an interactive reverse shell through the bash /dev/tcp pseudo-device, often chained with base64 decoding piped into bash. This technique was observed in opportunistic React2Shell exploitation to establish command-and-control after remote code execution on affected hosts.

Suspicious PowerShell Reverse-HTTP Shellcode Download via CVE-2024-4577 Exploitation

This rule detects PowerShell processes that download a payload.ps1 stager delivering reverse-HTTP shellcode from an external command-and-control host. The behavior follows exploitation of the PHP-CGI argument injection vulnerability CVE-2024-4577 on Windows servers seen in a broad mass-exploitation campaign. Attackers use it to gain remote code execution and deploy Cobalt Strike beacons for persistent access.

Possible Out-of-Band OAST Callback Domain Resolution via DNS

This rule detects DNS resolution of well-known out-of-band application security testing and interaction callback domains such as oast.fun, oast.pro, interact.sh, and burpcollaborator.net. These domains are used by exploitation tooling, including scanners for the BeyondTrust CVE-2026-1731 remote code execution flaw, to confirm blind vulnerabilities through out-of-band interaction. Resolution of these domains from server or internal hosts frequently signals active exploitation or reconnaissance against internet-facing services.