Sigma detection rules, expert-reviewed

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

This rule detects execution of the SharpGPOAbuse tool renamed to gpo.exe from the C:\Users\Public directory during a CrazyHunter ransomware intrusion. The attacker abuses Group Policy to push ransomware components domain-wide, so an unsigned GPO manipulation binary launched from a world-writable path signals defense evasion and preparation for mass deployment.

Malicious Event Log Clearing via Wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensics action used to erase traces of intrusion activity. This was observed during KawaLocker ransomware deployment alongside firewall and shadow copy tampering. Wiping logs removes the primary evidence responders use to trace attacker actions.

Malicious PowerShell Download Rename and Execute Chain via Script Block

This rule detects a PowerShell script block that downloads a file into the public directory with Invoke-WebRequest, renames it to an executable with Rename-Item, and launches it with Start-Process. RomCom uses this exact chain after its Firefox and Windows zero-day exploitation to stage and run its backdoor. This indicates scripted payload delivery following exploitation.

Malicious Privileged Container Launch With Host Root Mount via Docker

This rule detects a docker run command that starts a privileged container while bind mounting the host root filesystem which threat actors abusing exposed Docker and Kubernetes APIs use to escape the container and gain full control of the underlying node for cryptomining.

Malicious Domain Group Membership Change (via powershell)

This rule detects if a member is added to a domain group via PowerShell.

Suspicious Watering Hole Exfiltration to Fake wp-includes Endpoint via SilentSelfie

This rule detects HTTP POST requests to the path /wp-includes/ms-menu.php, a fake WordPress endpoint used by the SilentSelfie watering hole campaign to receive stolen geolocation, WebRTC IP and webcam selfie data from visitors of compromised Kurdish websites. The ms-menu.php filename does not exist in genuine WordPress installations. Traffic to it indicates victim data exfiltration.

Malicious TeamPCP Trivy C2 Beacon to ICP Canister and Cloudflare Tunnel (via dns_query)

This rule detects DNS resolution of the Internet Computer canister fallback host the Cloudflare tunnel and the aquasecurtiy typosquat domain used as command-and-control by the TeamPCP implant embedded in the compromised Trivy v0.69.4 release. These hosts serve payloads and receive exfiltrated credentials so a lookup indicates an infected build or developer host beaconing out.

Suspicious Execution of freenode Linux Backdoor Helper Binary

This rule detects execution of the helper binary used by the Linux backdoor from the freenode IRC network compromise. Observed in NCC Group research analyzing that Linux backdoor which deploys a helper at /bin/dh. Detecting this uncommon helper path helps surface rootkit-supported backdoor activity on Linux hosts.

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning PowerShell or cmd.exe, behavior produced when the GhostRedirector group abuses the xp_cmdshell stored procedure to run operating system commands. A database engine launching a shell indicates SQL-based remote code execution used for downloading tooling and establishing footholds on Windows servers.

Malicious QEMU SSH Tunnel via Scheduled Task on Nonstandard Port (via process_creation)

This rule detects a scheduled task launching qemu-system-x86_64 to establish an SSH tunnel on nonstandard port 22022, a covert access technique observed after SolarWinds Web Help Desk exploitation. Observed in Elastic Security Labs telemetry where a TPMProfiler task runs QEMU to proxy traffic and evade network controls for persistent remote access.

Malicious Event Log Clearing via wevtutil by The Gentlemen RaaS (via process_creation)

This rule detects wevtutil clearing the Security, Application, or System event logs, an anti-forensic action performed by The Gentlemen ransomware operators to erase traces of intrusion. Wiping logs hampers incident response and hides prior activity. Detection of log clearing is a strong indicator of hands-on-keyboard compromise.

Malicious Exchange Transport Agent Injection via Configuration File (via file_event)

This rule detects load an artifact in the Exchange transport agent.

Malicious Remote Process Creation via wmic node call create

This rule detects wmic invoking process call create against a remote node. The CloudComputating group used this WMI technique to execute commands on remote hosts for lateral movement across the network, which is uncommon in routine administration.

Suspicious Scheduled Task Running rundll32 DllRegisterServer Every Minute

This rule detects creation of a scheduled task that repeatedly invokes rundll32 against the DllRegisterServer export on a per-minute trigger. OysterLoader uses this technique to persist a malicious DLL dropped into the user profile. A minute interval task launching rundll32 with DllRegisterServer is rarely legitimate and typically indicates loader persistence.

Malicious Service Abuse with Malicious ImagePath - Reg via PowerShell (via powershell)

This rule detects modify the original service executable path with a malicious one.