Sigma detection rules, expert-reviewed

Malicious Replication Privileges Accessed to Perform DCSync Attack (via security)

This rule detects use DCSync or SecretDump tool to exfiltrate Active Directory credentials.

Suspicious Executable Persistence in Startup Folder (via file_event)

This rule detects an executable being written into the user Startup folder, the persistence method used by the VVS Discord stealer to relaunch itself at logon. Placing a binary under Start Menu Programs Startup guarantees the stealer re-executes on every user sign-in.

Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation

This rule detects the IIS worker process w3wp.exe spawning PowerShell with an encoded command argument, a behavior observed during active exploitation of the Gladinet CentreStack and Triofox insecure cryptography vulnerability where ViewState deserialization leads to code execution. Attackers abuse the hardcoded machineKey to forge ViewState payloads that execute PowerShell from the web application context. This chain indicates web-facing remote code execution and should be treated as a likely server compromise.

Suspicious cscript Execution of JavaScript Spawned by PowerShell

This rule detects powershell.exe spawning cscript.exe to run a JavaScript file, the ClickFix execution chain used by EddieStealer in which a pasted PowerShell command launches a downloaded .js loader. This parent-child relationship combined with script-host execution indicates fake-CAPTCHA social-engineering malware delivery.

PSEXEC Custom Named Service Binary

PSEXEC executed with non default service binary name

Malicious PlugX DLL Side-Loading via iviewers OLE Object Viewer (via image_load)

This rule detects the legitimate iviewers.exe OLE COM Object Viewer loading a co-located iviewers.dll from a non standard directory such as ProgramData. Velvet Ant abused DLL search order hijacking against this signed Windows SDK utility to load a PlugX loader and payload. Legitimate use of this tool loads its DLL from the SDK installation directory only.

Suspicious Wireless Credential Extraction via netsh wlan show profile in Katz Stealer (via process_creation)

This rule detects netsh.exe enumerating stored wireless profiles through the wlan show profile command, the WiFi credential extraction behavior performed by Katz Stealer during system profiling. Adversaries leverage netsh to recover saved network keys in clear text, making detection useful for identifying credential collection, though administrative troubleshooting can produce the same telemetry.

Suspicious SoftPerfect Network Scanner Execution (via process_creation)

This rule detects execution of the SoftPerfect Network Scanner, a discovery tool used by the Agrius group during MoneyBird operations to enumerate hosts and services on victim networks. While a legitimate administrative tool, its appearance on endpoints often precedes lateral movement and should be reviewed.

Malicious Microsoft Defender Whole-Drive Exclusion via PowerShell

This rule detects PowerShell adding the entire system drive as a Microsoft Defender exclusion path, an aggressive defense-evasion action used by Cyber Stealer to blind antivirus across the whole host. Excluding C drive from scanning is almost never legitimate and effectively disables Defender file protection, making this a high-confidence evasion indicator.

Suspicious Modification of dMSA Managed Account Link Attributes

This rule detects directory modifications to the msDS-ManagedAccountPrecededByLink or msDS-DelegatedMSAState attributes of a delegated Managed Service Account. The BadSuccessor attack abuses these dMSA attributes to inherit privileges from a targeted account and escalate in Active Directory. Changes to these attributes outside sanctioned administration indicate an escalation attempt.

Possible CVE-2023-23397 Outlook Forced Authentication via Outbound SMB (via network_connection)

This rule detects a Windows host initiating an outbound SMB connection on TCP 445 to a non-private external address. CVE-2023-23397 abuses a Microsoft Outlook reminder property carrying a UNC path to coerce the host into leaking Net-NTLMv2 credentials to an attacker-controlled SMB server. Successful forced authentication lets adversaries relay or crack the hash so the residual leak of a domain credential must be triaged.

Suspicious NTDS Database Access via Command Line (via process_creation)

This rule detects command lines referencing the ntds.dit Active Directory database, which was staged along with the SECURITY and SYSTEM registry hives for credential extraction in a ShadowPad intrusion. Access to ntds.dit outside of backup software is a strong credential theft indicator. Copying the directory database yields every domain account hash for offline cracking and forgery.

Suspicious winhlp32 Network Connection Indicating RemcosRAT Injection

This rule detects winhlp32.exe establishing an external network connection, behavior the legacy help viewer never performs and used in the OnlyDcRatFans intrusion as the injection host for RemcosRAT command and control. An outbound connection from winhlp32 signals injected malicious code beaconing to an attacker server.

Malicious macOS Credential Verification via dscl authonly

This rule detects use of dscl with the authonly flag to validate a captured password against the local directory service, a technique used by the AMOS stealer to confirm harvested credentials after phishing the user. Legitimate interactive use of dscl authonly is rare. This behavior indicates active credential access and verification on the host.

Malicious Kimsuky Keylogger PowerShell Functions PokDoc and InfoKey (via ps_script)

This rule detects PowerShell script content containing the PokDoc and InfoKey function names used by the Kimsuky implant observed against Japanese organizations. These function names are implant-specific keylogging and document-collection routines, so their presence in scriptblock logs indicates hands-on infostealer activity.