Sigma detection rules, expert-reviewed

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

This rule detects the Bun JavaScript runtime spawning the TruffleHog secret scanner, a behavior chain used by the Shai-Hulud worm to harvest credentials from developer and CI environments. Adversaries abuse the legitimate TruffleHog tool during package install hooks to locate secrets before exfiltrating them, so this parent-child pairing is a strong indicator of automated credential collection.

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

This rule detects registration of a rogue self-hosted GitHub Actions runner using the runner.listener binary with unattended flags and the SHA1HULUD name marker tied to the second-wave Shai-Hulud supply chain worm. Attackers register malicious runners to obtain persistent code execution inside CI/CD pipelines and spread across repositories, enabling mass credential theft and downstream package poisoning.

Malicious Hidden Virtual Machine Launched via QEMU for Persistence

This rule detects QEMU started with a qcow2 disk image and a user mode network device which adversaries use to run a concealed virtual machine on the host to evade endpoint detection and maintain persistence. Running malicious tooling such as Sliver inside an attacker supplied VM hides its activity from host based sensors. Detecting these QEMU arguments surfaces the bring your own virtual machine technique.

Malicious Data Exfiltration via curl with Stealer Specific BuildID Header

This rule detects curl invoked with the custom BuildID or buildid HTTP header used by the Atomic and Odyssey macOS information stealers to exfiltrate collected data to their command and control servers. These distinctive headers identify the stealer build during the collection upload. Detecting them surfaces active credential and data theft on macOS endpoints.

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

This rule detects AteraAgent executed with IntegratorLogin and CompanyId parameters which perform a silent unattended enrollment of the Atera remote monitoring agent. Adversaries in phishing campaigns delivering RMM tools use these switches to covertly onboard victim hosts into an attacker controlled Atera tenant. Detecting this command line surfaces unauthorized remote access tool deployment.

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

This rule detects chrome.exe or msedge.exe launched with a remote debugging port together with a profile directory argument, the app-bound encryption bypass Red Canary observed across Stealc, Vidar, Cryptbot, Remcos, and Lumma stealers. Attackers drive a headless debugging session to read decrypted cookies from a live browser profile, so this argument combination indicates credential and session theft.

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

This rule detects execution of dllCrt32.exe or sysCrt32.exe from the LOCALAPPDATA Microsoft WindowsApps directory, the dropped stealer binaries Red Canary attributed to dllFake trojanized installers that share code with SecondEye. These named executables in the WindowsApps path are not legitimate Store aliases, so their execution indicates a data-stealing implant staged for credential and clipboard theft.

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning cmd.exe, the webshell execution behavior Red Canary observed during a hospital ransomware intrusion where the shell ran net.exe reconnaissance before lateral movement and Cobalt Strike deployment. A web server worker launching an interactive command shell is a strong sign of a deployed webshell running operating-system commands, making early detection critical for catching post-exploitation before ransomware.

Malicious Microsoft Defender Real-Time Monitoring Disabled via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling Microsoft Defender real-time monitoring through the Set-MpPreference DisableRealTimeMonitoring parameter, a defense-evasion behavior Red Canary observed in a hospital ransomware intrusion where wmiprvse.exe spawned PowerShell ahead of Cobalt Strike deployment. Adversaries use this to blind endpoint protection before payload execution and lateral movement, making early detection critical for stopping ransomware before encryption.

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

This rule detects wscript.exe executing a .js payload from a temporary archive-extraction directory under the user AppData Local Temp path, the delivery behavior Red Canary tied to SocGholish, Gootloader, and Scarlet Goldfinch fake-update lures. Victims download an archive such as Update - 35129.zip, extract it, and double-click a script like Update_123.0.6312.111.js which Windows Script Host runs, so this pattern surfaces script-based initial access before the follow-on payload executes.

Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)

This rule detects the contents of /etc/shadow being read and piped to a bash /dev/tcp network socket, the password-hash exfiltration example from Red Canary's Linux detection guide. Combining access to the credential store with a raw network channel is an unambiguous attempt to steal hashes for offline cracking.

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

This rule detects the classic Linux netcat reverse shell built on a FIFO created with mknod, the interactive shell technique Red Canary covers in its detection engineer guide to Linux. Chaining a named pipe with netcat backconnects a shell to an attacker while avoiding the need for a netcat build that supports the exec flag.

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

This rule detects the SQL Server process spawning cmd.exe or powershell.exe, the xp_cmdshell execution that follows SQL injection against FortiClientEMS in the CVE-2023-48788 exploitation Red Canary reported. A database engine launching a command interpreter is a classic sign of xp_cmdshell abuse turning a SQL flaw into operating system code execution.

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

This rule detects PowerShell adding Windows Defender exclusions or disabling real-time monitoring via Add-MpPreference or Set-MpPreference, a defense-evasion step used by malware delivered through MSIX installers per Red Canary. Attackers carve out exclusion paths so their staged payloads run unscanned, making unexpected exclusion changes a strong impairment-of-defenses signal.