Sigma detection rules, expert-reviewed

Suspicious utmpdump Usage for wtmp Log Manipulation

This rule detects the utmpdump utility referencing the wtmp utmp or btmp accounting files. Operators infiltrating global telecom networks use utmpdump to dump edit and reload login records to erase evidence of their sessions. Interactive use of utmpdump against these files is a strong anti-forensics signal.

Malicious Disabling of Carbon Black EDR Service via sc config

This rule detects the sc command reconfiguring the Carbon Black cbdefense service start type to disabled. Sinobi actors disabled the endpoint protection service before deploying ransomware to blind defenders. Disabling a named EDR service through sc config is a deliberate defense-evasion step that precedes encryption and should be treated as a critical event.

Malicious JanelaRAT DLL Side-Loading via nevasca.exe (via image_load)

This rule detects the host binary nevasca.exe loading the malicious PixelPaint.dll used by JanelaRAT to hijack execution flow through DLL side-loading. JanelaRAT is a financial remote access trojan targeting users in Latin America. Detecting this loader pair exposes the in-memory execution of the RAT before command-and-control is established.

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious SAM and SYSTEM Hive Dump via reg save

This rule detects reg.exe saving the SAM or SYSTEM registry hives to disk which the Librarian Ghouls APT exports to a staging folder to harvest local credentials offline. Dumping these hives enables offline password and secret extraction after gaining local admin. Reg save of security hives is rarely part of legitimate administration.

Malicious Service Creation for DcRAT Persistence via sc.exe (via process_creation)

This rule detects use of sc.exe to create the MixedSvc service pointing at a masqueraded Mixed Reality.exe binary under the Windows Media Player folder, the persistence mechanism used by Operation DragonReturn to survive reboots. The actor abused Windows service control to auto-start its DcRAT loader with SYSTEM privileges, making this a high-value chokepoint for catching the intrusion before code injection into svchost.

Malicious Eldorado Ransomware Ransom Note Creation

This rule detects the creation of the HOW_RETURN_YOUR_DATA.TXT ransom note dropped by Eldorado ransomware across encrypted directories. The note appears once encryption completes and delivers the extortion demand. It matters because its widespread creation confirms an active Eldorado impact event on the host or shares.

Malicious MoustachedBouncer Service DLL Hijack of WmdmPmSp via Registry (via registry_set)

This rule detects modification of the legitimate WmdmPmSp service ServiceDll value to point at the malicious creh.dll, a persistence method used by the MoustachedBouncer toolset. Hijacking an existing service DLL lets the implant run inside a trusted svchost process and survive reboots.

Malicious Defender Real-Time Monitoring Disabled by The Gentlemen RaaS (via process_creation)

This rule detects Set-MpPreference invoked to disable Microsoft Defender real-time monitoring, a defense-evasion step used by The Gentlemen ransomware operators before deploying tooling. Turning off real-time protection lets subsequent payloads run unimpeded. Catching this reveals active tampering with endpoint defenses.

Possible Sitecore Path Traversal via ValidateXHtml PAGESTATE Injection

This rule detects requests to the Sitecore EditHtml.ValidateXHtml handler carrying a __PAGESTATE parameter with directory traversal sequences, matching the order-of-operations bug that Assetnote leveraged to reach RCE in Sitecore 8.x to 10.x. The traversal in the page-state value leaks server paths and enables the subsequent exploitation chain. Early detection of this handler abuse exposes reconnaissance before code execution.

Malicious Container Escape via core_pattern Hijack (via process_creation)

This rule detects a process writing to the kernel core_pattern handler under proc sys kernel, a technique used in the BrokenSesame research to break out of a container by having a crash trigger execution on the host. Attackers set core_pattern to a pipe handler and then force a segfault to run code with host privileges. Modification of this kernel path from a workload is a strong escape signal.

Malicious BadIIS SEO Poisoning C2 Request via Web Server (via webserver)

This rule detects HTTP requests to the hardcoded BadIIS command-and-control endpoint used by the Operation Rewrite SEO poisoning campaign. The BadIIS native IIS module intercepts requests and communicates with attacker infrastructure through this fixed URI path. Detecting these requests exposes a compromised IIS server acting as a malicious proxy for SEO fraud and traffic redirection.

Malicious PHP Webshell Dropped in PAN-OS Unauthenticated Web Root

This rule detects a PHP file being written under the PAN-OS management web root path /var/appweb/htdocs/unauth/ which Wiz observed attackers using to drop webshells while exploiting CVE-2024-0012 and CVE-2024-9474 in the wild. This is important because the unauth directory should never contain attacker PHP scripts so a new PHP file there is a high confidence indicator of authentication bypass followed by webshell installation on the firewall.

Malicious RDP Shadow Session Started - Command (via process_creation)

This rule detects would attempt to shadow a RDP session.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.