Sigma detection rules, expert-reviewed

Suspicious Rundll32 Execution Without a DLL Reference via Process Creation (via process_creation)

This rule detects rundll32.exe executing without any .dll referenced on its command line, a pattern associated with Qbot (Qakbot) module loading as documented by Red Canary during the coordinated takedown. Legitimate rundll32 invocations almost always reference a DLL, so an execution lacking one is a strong indicator of injected or reflectively loaded malicious code worth investigating.

Suspicious Inbox Rule Creation That Deletes Incoming Mail via Exchange (via m365)

This rule detects the creation or modification of Exchange inbox rules that silently delete or hide incoming mail, a technique used in the back-to-school email account compromise campaign reported by Red Canary. Adversaries who take over an educational mailbox create hidden rules with obscure names to auto-delete replies and warnings while they conduct internal spearphishing, and this activity should be reviewed to catch account takeover before it spreads.

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

This rule detects a Google Workspace OAuth authorize event granting the Chrome Web Store management scope to a third-party application such as the Privacy Policy Extension app seen in this supply chain campaign. Attackers trick users into authorizing apps that can publish or modify Chrome extensions, enabling downstream compromise of every user who installs the affected extension.

Suspicious OpenClaw Skill File Modification via File Event

This rule detects creation or modification of files under the OpenClaw skills directory, the mechanism attackers abuse to implant malicious agent skills that execute on the next agent run. Because skills are executable instructions loaded automatically, unexpected writes to the .openclaw/skills path indicate tampering that leads to code execution and credential theft.

Suspicious PowerShell Writing Shortcut to Startup Folder for Persistence (via file_event)

This rule detects powershell.exe creating a .lnk shortcut inside the Start Menu Programs Startup folder, the Yellow Cockatoo persistence Red Canary tied to a PowerShell payload staged from AppData. Writing a shortcut to the startup folder guarantees re-execution at logon, so a script host dropping a .lnk there indicates autorun persistence.

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

This rule detects DNS queries to dynamic DNS and tunneling provider domains frequently abused by commodity remote access trojans such as XWorm AsyncRAT DCRat and njRAT for command and control. These providers let adversaries map attacker infrastructure to disposable hostnames and tunnel traffic past network controls. Detecting lookups to these domains surfaces potential RAT beaconing that warrants investigation.

Suspicious Federated Identity Credential On-Behalf-Of Token Flow via Sign-In Logs

This rule detects token requests using the user_fic grant type against a federated identity credential, the on-behalf-of flow abused to let a compromised Entra agent act as a user without a stored secret. Attackers leverage federated identity credentials to obtain user-context tokens for AI agents and pivot into mailboxes and Teams, so this grant type is a strong signal of agent identity abuse.

Suspicious Credential Addition to Entra Application via Azure Audit Logs

This rule detects a new password or certificate being added to an Entra application or agent blueprint, corresponding to the addPassword call used to hijack AI agent identities. Attackers attach their own credentials to an existing app registration to obtain long-lived authentication as that identity, so unexpected secret additions indicate service principal credential abuse and persistence.

Suspicious Service Principal Creation via Azure Audit Logs

This rule detects creation of a new service principal in Entra ID, an action attackers perform after illicit OAuth consent to register their own application identity for persistent tenant access. Newly added service principals with broad Graph scopes can read mail and files and move through cloud resources, making unexpected additions a meaningful signal of account or app abuse.

Suspicious OAuth Application Consent Grant via Azure Audit Logs

This rule detects user or admin consent granted to an OAuth application in Entra ID, the pivot point in illicit consent phishing campaigns where victims authorize attacker-controlled apps requesting sensitive Graph permissions. Adversaries use consented apps to read mail and files and to establish durable API access that survives password resets, so unexpected consent events warrant review.

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

This rule detects the Azure OpenAI Models_List and Deployments_Create operations that Red Canary described adversaries using to enumerate available models and stand up new deployments after obtaining access to a resource. Reconnaissance of models followed by deployment creation can indicate an actor preparing to abuse a victim Azure OpenAI service for inference at the owner expense.

Suspicious Azure Cognitive Services Account Key Enumeration via ListKeys (via azure)

This rule detects the Cognitive Services ListKeys action in Azure activity logs, the API-key retrieval step Red Canary observed adversaries using to obtain persistent Azure OpenAI credentials. Because the returned key does not expire unless regenerated, unexpected ListKeys calls against a Cognitive Services account can indicate an actor acquiring durable access for later model abuse.

Suspicious Entra ID Application Consent Failure Indicating Unauthorized OAuth Grant Attempt (via azure)

This rule detects Entra ID sign-in failures carrying error codes 65001 and 90095 which represent an unapproved application consent attempt and a denied admin-consent request. Red Canary observed adversaries triggering these consent errors while trying to authorize rogue OAuth applications for mailbox access in business email compromise schemes, so a cluster of these failures can reveal an in-progress service principal abuse attempt.

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

This rule detects Entra ID sign-ins tied to the PerfectData Software and eM Client OAuth application identifiers that Red Canary observed adversaries abusing to gain persistent mailbox access during business email compromise schemes. Attackers consent these third-party mail applications into a compromised tenant so they can read and exfiltrate mail through issued tokens without the victim password, making any sign-in with these application IDs a strong compromise indicator.

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

This rule detects AWS STS GetCallerIdentity calls carrying a TruffleHog user agent, a validation step the Shai-Hulud worm performs against stolen access keys before exfiltration. Attackers confirm harvested cloud credentials are valid prior to abuse, so TruffleHog-attributed API activity in production accounts indicates credential theft and reconnaissance.