Sigma detection rules, expert-reviewed

Obfuscated Encoded PowerShell Payload Deployed via Service (via security)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe

This rule detects a PowerShell binary copied to wt.exe under ProgramData and executed with a hidden window and execution policy bypass, matching the Axios NPM supply chain incident where a post-install hook drops a RAT. Renaming powershell.exe to wt.exe masquerades the interpreter as Windows Terminal to evade name-based detection. Execution of a masqueraded interpreter from ProgramData with bypass flags is a strong compromise indicator.

Microsoft Defender SpyNet Reporting Disabled via Registry

This rule detects the Microsoft Defender SpyNetReporting registry value being set to 0, disabling cloud-delivered protection telemetry so malware runs with reduced detection. Huntress observed BlackCat affiliates degrading Defender before payload deployment. Turning off SpyNet reporting is a deliberate defense-evasion action rarely performed by legitimate administration.

Malicious Mimikatz Driver Deployed via Service (via security)

This rule detects installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

Malicious Impacket WMIexec Execution via SMB Admin Share (via security)

This rule detects remotely execute WMIexec via SMB admin share in order to escalate privileges.

Suspicious Reverse Shell via socat EXEC Redirection

This rule detects socat invoked with an EXEC or SYSTEM redirection to a shell, a reverse shell pattern shown in Elastic Linux persistence research. Attackers pair a socat TCP endpoint with EXEC to pipe an interactive shell back to a listener for command and control. Socat spawning a shell process is uncommon in normal administration and points to remote-access tooling.

Malicious Microsoft Defender Threat Exclusion Added - PowerShell (via powershell)

This rule detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities.

Suspicious Daxin Backdoor Driver srt64.sys Loaded

This rule detects loading of a kernel driver named srt64.sys, associated with the Backdoor.Daxin espionage implant that hijacks legitimate network connections for covert command and control against hardened networks.

Malicious Impacket wmiexec Output Redirection via ADMIN Share

This rule detects the characteristic Impacket wmiexec command line that redirects command output to a temporary file on the local admin share over the loopback address as described in the WithSecure WMI lab. This redirection pattern is highly specific to semi interactive Impacket WMI execution and is a strong indicator of remote lateral movement by an attacker toolkit.

Suspicious Side-Loaded DLL Loaded by SSH Agent for Lazarus ServiceChanger

This rule detects the ssh-agent binary loading a libcrypto.dll from a non-standard path, a side-loading chain abused by the Lazarus ServiceChanger tool. The attackers convert ssh-agent into a persistent service and hijack its DLL dependency to run malicious code. A libcrypto.dll loaded by ssh-agent outside trusted install paths indicates side-loading.

Malicious Modification of a Fake Domain Controller SPN (DCshadow) - Directory Services (via security)

This rule detects update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.

Malicious Process Memory Injection via dd Write to /proc/pid/mem by UNC3886 (via process_creation)

This rule detects the dd utility writing to a process memory file under /proc, the injection primitive UNC3886 used to load TINYSHELL backdoors into legitimate processes on Junos OS routers. Direct writes to another process memory are a strong indicator of code injection and defense evasion.

Suspicious Shai-Hulud 2.0 Harvested Secret Dump File Creation

This rule detects creation of the secret dump files written by the Shai-Hulud 2.0 supply chain worm after it scans the host for cloud credentials and TruffleHog secrets during package install. These fixed filenames hold harvested AWS Azure and GCP credentials staged for exfiltration to attacker-controlled GitHub repositories.

Malicious Chrome Relaunch Hijack by FlutterShell Backdoor on macOS (via process_creation)

This rule detects Google Chrome being relaunched with restore-session arguments pointing at the sinterfumesco.com domain, a browser-hijack step of the FlutterShell backdoor from Operation FlutterBridge. The malware kills and restarts Chrome to redirect the victim to attacker-controlled search infrastructure.

Malicious Interactive Reverse Shell on Linux (via process_creation)

This rule detects Linux command lines that establish an interactive reverse shell, including bash redirection to /dev/tcp, netcat with command execution, or a named-pipe backpipe. Reverse shells are a common execution and command-and-control behavior across the Linux intrusions summarized in the Red Canary Threat Detection Report. Detecting these constructs surfaces hands-on-keyboard access to the host.