Sigma detection rules, expert-reviewed

Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)

This rule detects creation of Troll Stealer staging files under the local AppData folder that follow the tokenized naming scheme used for exfiltration containers such as tsd, tfd, tbd and ccmd with the .gte1 extension. These encrypted collection files hold stolen SSH, FileZilla, browser and system data prior to upload, making their creation a high-confidence sign of active data theft.

Suspicious Scheduled Task SystemSoundsService2 Creation via Process Creation

This rule detects creation of a scheduled task named SystemSoundsService2 through schtasks.exe, a masquerading name GoldenJackal uses to persist its air-gap tooling on government systems. The name imitates a legitimate Windows sounds service to blend in. This indicates scheduled-task persistence by an espionage actor.

Suspicious XScan Network Vulnerability Scanner Execution After Citrix Bleed Exploitation

This rule detects execution of the XScan network scanner with finger and vulnerability scanning flags against a subnet, matching internal reconnaissance seen after Citrix Bleed exploitation by Unit 42. Adversaries sweep the environment for hosts and weaknesses which precedes lateral movement and marks an active operator on the network.

Suspicious Curl Download and Script Execution Chain via Command Line

This rule detects a single command line that downloads an archive with curl, expands it with PowerShell, and executes a VBScript with wscript, matching the PyLangGhost RAT initial delivery chain. This staged download-and-run pattern is characteristic of fake job-interview lures deploying Python-based RATs.

Suspicious Image File Execution Options Debugger Hijack by Miner Campaign

This rule detects creation of a Debugger or MonitorProcess value under Image File Execution Options, an IFEO hijack the Wazuh-agent miner campaign uses for persistence and to launch its payload when a targeted process starts. IFEO debugger entries are seldom set legitimately and are a well-known persistence and injection vector.

Malicious node Reverse Shell Spawned on FortiGate via Inline Code

This rule detects the node binary being executed with the -e flag to run inline JavaScript, matching the reverse shell payload delivered through the FortiGate CVE-2024-21762 exploitation described by Assetnote. Attackers use node -e to establish an outbound interactive shell from the appliance after triggering the memory corruption. Inline node execution on a network security appliance is highly abnormal and indicates post-exploitation activity.

Suspicious SQL Server - Member Got New Privileges Added on a Database (via application)

This rule detects grants new privileges on a database level.

Suspicious AWS Console Login Without MFA

This rule detects a successful AWS Management Console sign-in where additionalEventData.MFAUsed is No, indicating interactive access with only a password or root credentials and no second factor. Adversaries who compromise console credentials rely on non-MFA logins to gain hands-on-keyboard access, a pattern GuardDuty also flags as IAMUser ConsoleLoginSuccess. This is important because non-MFA console logins are a primary indicator of account takeover.

Malicious ClickFix PowerShell IEX DownloadString Execution

This rule detects PowerShell running with no-profile and bypass execution policy while using DownloadString and IEX to fetch and run a remote payload, the EVALUSION ClickFix loader. Victims were social-engineered into executing this command which pulled Amatera Stealer and NetSupport RAT from attacker infrastructure. The combination of policy bypass and an in-memory download cradle is a high-confidence execution indicator.

Suspicious Security Center Health Notification Hidden via Registry

This rule detects modification of the Explorer policy value that hides the Security and Maintenance health notifications which the Trigona actor set to suppress warnings while disabling protections and this matters because hiding security health alerts is a user impact evasion technique meant to keep victims unaware of a degraded security posture.

Malicious NTDS.dit Copy for Domain Credential Theft (via file_event)

This rule detects an ntds.dit Active Directory database file being written to disk, the credential-theft step where Muddled Libra copies the domain database and SYSTEM hive from a mounted VMDK. Extracting ntds.dit yields every domain account hash for offline cracking and full domain compromise.

Malicious COM Hijack via CLSID InProcServer32 Registry Modification (via registry_set)

This rule detects a COM hijack targeting the CLSID 2227A280-3AEA-1069-A2DE-08002B30309D by writing to its InProcServer32 registry value. In Operation Phantom Net Voxel APT28 abuses this specific shell folder CLSID so that explorer loads a malicious DLL for persistence and execution. Redirecting this InProcServer32 value to an attacker DLL is a reliable indicator of COM hijacking.

Malicious Scheduled Task for Cryptominer Persistence at Logon (via process_creation)

This rule detects creation of the Monero mining operation scheduled tasks that run at logon with highest privileges. Observed in the Elastic Security Labs fake-installer campaign where SVCConfig or HostDataProcess tasks with ONLOGON and HIGHEST run levels persist the XMRig miner.

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious Ntospy Network Provider DLL Registration for Credential Capture

This rule detects registration of a malicious Network Provider DLL under the credman service key, matching the Ntospy credential-stealing component used against organizations in the Middle East, Africa and the US per Unit 42. Registering a rogue authentication package as a network provider lets the actor intercept plaintext logon credentials which enables persistent credential theft.