Sigma detection rules, expert-reviewed

Suspicious winhlp32 Network Connection Indicating RemcosRAT Injection

This rule detects winhlp32.exe establishing an external network connection, behavior the legacy help viewer never performs and used in the OnlyDcRatFans intrusion as the injection host for RemcosRAT command and control. An outbound connection from winhlp32 signals injected malicious code beaconing to an attacker server.

Malicious macOS Credential Verification via dscl authonly

This rule detects use of dscl with the authonly flag to validate a captured password against the local directory service, a technique used by the AMOS stealer to confirm harvested credentials after phishing the user. Legitimate interactive use of dscl authonly is rare. This behavior indicates active credential access and verification on the host.

Malicious Kimsuky Keylogger PowerShell Functions PokDoc and InfoKey (via ps_script)

This rule detects PowerShell script content containing the PokDoc and InfoKey function names used by the Kimsuky implant observed against Japanese organizations. These function names are implant-specific keylogging and document-collection routines, so their presence in scriptblock logs indicates hands-on infostealer activity.

RedCurl QWCrypt Ransomware Execution with Hyper-V Targeting Flags

This rule detects the QWCrypt ransomware binary launched with its distinctive command line flags that target Hyper-V virtual machines while excluding gateway hosts and disabling shadow copies during encryption.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs. LockBit clears event logs during deployment to erase evidence of its activity and hinder incident response, so a log-clear command is a strong defense-evasion indicator.

Malicious Remote Process Creation via WMIC Node

This rule detects wmic invoking process call create against a remote node which the ALPHV actor used to launch payloads on other hosts during lateral movement and this matters because remote process creation through wmic is a well established lateral movement primitive that is uncommon in day to day administration and warrants scrutiny.

Suspicious Decoy Copy and Rename of PDF to Executable (via process_creation)

This rule detects a malicious LNK using xcopy or ren to copy a decoy PDF and rename it into an executable or DLL as part of a Cobalt Strike delivery chain distributed via GitHub and Quora dead-drops. Disguising a payload as a document and flipping the extension at runtime lets the attacker present a benign lure while planting the real loader on disk.

Malicious APT-C-60 COM Hijack via SpyGlace CLSID InProcServer32 (via registry_set)

This rule detects registry modification of the InProcServer32 value for the specific CLSIDs abused by APT-C-60 for COM hijacking to load the SpyGlace backdoor. Pointing these class identifiers at an attacker DLL provides stealthy persistence and execution whenever the hijacked COM object is instantiated.

Suspicious Download LOLBIN Spawned by ScreenConnect Client

This rule detects the ScreenConnect client service spawning download utilities such as bitsadmin or PowerShell which is the payload retrieval chain that dropped KrustyLoader after a ScreenConnect exploit as described by WithSecure. Remote monitoring tools launching download LOLBINs shortly after exploitation frequently indicates ingress tool transfer of a second stage.

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

This rule detects AWS Organizations and account enumeration API calls that map the blast radius of compromised access keys. Unit 42 observed this cloud service discovery during the SugarCRM incident where stolen credentials were used to survey the target environment before resource abuse, so alerting is warranted when these calls come from unexpected principals.

Suspicious Process Memory Dump via ProcDump Full Dump Flag

This rule detects ProcDump invoked with the accept eula and full memory dump flags which the NetSupport actor used through a renamed binary to capture process memory including LSASS and this matters because full memory dumps of running processes are a common credential access technique and the renamed binary reflects deliberate evasion of image name detections.

Suspicious Payload Staging in Public Libraries Directory via file_event

This rule detects database style config files being written to the Users Public Libraries directory, the staging location GoSerpent uses for its encrypted configuration and collected data. This path is not a normal write target for applications. Files appearing here indicate backdoor staging and data collection.

Malicious Defender Exclusion for Executables via Add-MpPreference (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion by file extension through Add-MpPreference with ExclusionExtension, the defense-evasion behavior used by the Lua-based loader targeting the education and gaming sectors to exempt executable and library files from scanning. Adversaries leverage this to blind Defender across whole drive extensions before dropping payloads, making early detection critical for stopping the loader before persistence and C2 are established.

Malicious Windows Event Log Clearing via Wevtutil

This rule detects wevtutil being used to clear the Security or System event logs, an anti-forensic action that destroys traces of intrusion activity. The Gentlemen ransomware clears these logs to hinder incident response. Detecting the log wipe exposes deliberate defense evasion during a ransomware attack.

Suspicious Domain Admins Group Enumeration via net.exe (via process_creation)

This rule detects enumeration of the Domain Admins group with net localgroup and the /domain switch, used for privilege-mapping discovery during a compromised-vendor intrusion. Attackers query privileged group membership to identify high-value accounts before lateral movement. While administrators occasionally run this, its appearance alongside credential dumping is high signal.