Sigma detection rules, expert-reviewed

Malicious Domain Admin Account Escalation via net group (via process_creation)

This rule detects a net group command adding an account to the Domain Admins or Enterprise Admins group over the domain. Operators exploiting BeyondTrust Remote Support via CVE-2026-1731 created a domain account and escalated it into these privileged groups.

Suspicious WinSvcUpd Scheduled Task Persistence via schtasks (via process_creation)

This rule detects creation of a scheduled task named WinSvcUpd that runs PowerShell with a bypassed execution policy at logon with highest privileges. The GPUGate malware registered this task masquerading as a Windows update service for persistence.

Malicious macOS.Gaslight Persistence via Apple-Namespace LaunchAgent (via file_event)

This rule detects creation of the LaunchAgent property list that the macOS.Gaslight Rust backdoor uses for persistence, masquerading inside the Apple com.apple namespace with the label com.apple.system.services.activity. Genuine Apple daemons are not installed as user LaunchAgents under this exact label. Its presence indicates the Gaslight implant is establishing persistence.

Suspicious Outlaw Payload Download via wget dota Archive

This rule detects wget or curl retrieving the Outlaw botnet staging script or the dota.tar.gz archive that unpacks the miner and SSH brute-force components. This download step bootstraps the full infection after initial access on a Linux host. The specific script and archive names are consistent Outlaw distribution artifacts.

Suspicious Scheduled Task TPMProfiler Executing QEMU Emulator

This rule detects creation of a scheduled task named TPMProfiler or a task configured to run qemu-system-x86_64, the persistence and execution mechanism observed after SolarWinds Web Help Desk exploitation where a QEMU emulator was launched to evade host-level inspection. Masquerading a task as a benign TPM profiler while it starts a full system emulator is a deliberate concealment tactic. This pairing of task name and QEMU binary is a reliable compromise indicator.

Malicious Linux XorDDoS gcc.pid Device Marker File via file_event

This rule detects creation of the /var/run/gcc.pid device-identifier file that the Linux XorDDoS trojan reads and writes to track infected hosts. This hardcoded artifact path is a distinctive marker of the XorDDoS campaign delivering DDoS malware, so its appearance indicates an active infection.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects the rclone utility being run with copy, sync or transfer-tuning flags that indicate bulk movement of files to a remote cloud endpoint. Emotet-related intrusions abuse rclone to exfiltrate collected data to attacker cloud storage before disruptive follow-on activity. Automated cloud transfers driven from an endpoint are a common precursor to extortion and should be reviewed.

MintsLoader AMSI Bypass via amsiInitFailed Reflection (via ps_script)

This rule detects the MintsLoader in-memory AMSI bypass that reflectively sets the amsiInitFailed field on the AmsiUtils type to disable the Antimalware Scan Interface before staging the next payload. Adversaries leverage this bypass to run malicious PowerShell content without scanning, making it a high-confidence defense-evasion indicator.

Malicious Hiloti Configuration Registry Key Creation (via registry_set)

This rule detects creation of the Bfetipi registry key under the Windows software hive, a configuration and persistence artifact of the Hiloti DNS-tunneling malware observed in Unit 42 daily tunneling detections. This non-standard key name is unique to the malware family and indicates infection.

Malicious Port Forwarding Tunnel via Netsh Portproxy (via process_creation)

This rule detects netsh interface portproxy commands that create a local port-forwarding tunnel, which adversaries use to relay traffic through a compromised host and reach otherwise unreachable internal systems. Netsh portproxy tunneling is a command-and-control and lateral-movement technique in the Red Canary Threat Detection Report. Detecting the tunnel setup surfaces network pivoting through the endpoint.

Malicious Perl Reverse Shell Execution on Linux

This rule detects a perl one liner that opens a network socket and connects back to a remote host and hands it to a shell which the opportunistic Log4j campaign uses to spawn an interactive reverse shell after exploiting a vulnerable server.

Malicious Firewall Rule Any/any Created (via firewall-as)

This rule detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious pythonw.exe Executing LICENSE.txt Downloader from AppData

This rule detects a hidden pythonw.exe process launched from the AppData Local directory with a LICENSE.txt argument, matching an AI-themed lure that drops a Python downloader loading shellcode. Running a Python interpreter over a text file disguised as a license from a user writable path is a strong sign of staged malware execution.

Suspicious UAC Bypass via CMSTP INF Auto-Install

This rule detects execution of cmstp.exe with the auto-install switch pointing to an INF file, a technique used to bypass User Account Control and execute arbitrary commands at high integrity. The Sliver C2 framework and multiple threat actors abuse this living-off-the-land binary to elevate privileges while evading defenses. Detecting it early helps stop attacker privilege escalation before further post-exploitation activity.