Sigma detection rules, expert-reviewed

Possible Task Manager Access Indicator for Potential LSASS Dump (via process_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Suspicious Cloudflare Tunnel Masquerading as conhost.exe During Medusa Operations (via process_creation)

This rule detects a binary named conhost.exe running Cloudflare tunnel arguments, a masquerade Storm-1175 uses by renaming the cloudflared client to conhost.exe to establish covert command and control during Medusa ransomware operations. Legitimate conhost.exe never runs tunnel parameters, so this combination surfaces a disguised tunneling channel used for remote access and exfiltration.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.

Malicious WinRing0 Vulnerable Driver Load

This rule detects loading of the WinRing0 kernel driver which the BlueSky actor deployed as a bring your own vulnerable driver to tamper with protected processes and disable security controls and this matters because this signed but abusable driver grants ring zero access and its presence outside of the few legitimate hardware utilities that ship it is a strong indicator of defense evasion.

Suspicious PowerShell Remote Script Execution From GitHub via irm and iex (via process_creation)

This rule detects the multi stage Windows campaign loader running PowerShell that pipes an Invoke-RestMethod download of a raw GitHub hosted script into Invoke-Expression for fileless execution. Fetching and executing raw GitHub content in memory is a hallmark of the initial loader. Later stages disable Defender and deploy a RAT and ransomware.

Suspicious Cloud Sign-In From an Anonymizer or High-Risk Session (via signinlogs)

This rule detects an Entra ID sign-in flagged with an anonymized IP address or a high real-time risk level, indicating access through Tor or a VPN anonymizer or from a session Microsoft's risk engine deems likely compromised. Compromise of cloud accounts is the most prevalent technique in the Red Canary Threat Detection Report. Detecting anonymized and high-risk sign-ins surfaces suspicious identity access at the authentication boundary.

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

This rule detects HTTP requests to an All-in-1.php endpoint carrying user and password query parameters characteristic of the GTFire phishing scheme credential harvesting kit. GTFire lures victims through translate.goog and web.app redirect hops before submitting stolen credentials via crafted GET parameters. Surfacing this traffic reveals active phishing credential theft against organization users.

SystemNightmare by GentilKiwi - New External Device Added - CVE-2021-1675 / CVE-2021-34527 (via security)

This rule detects exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi.

Malicious ESXi Virtual Machine Termination and Snapshot Removal via esxcli and vim-cmd (via process_creation)

This rule detects the ESXi shell loops used by Lynx ransomware to force-kill running virtual machines with esxcli vm process kill and to remove all snapshots with vim-cmd snapshot.removeall as described by Group-IB. Adversaries stop VMs and delete snapshots to enable datastore encryption and inhibit recovery on hypervisors, making this a strong pre-encryption signal.

Suspicious Winlogon Loading Keyboard Layout DLL kbdus1.dll

This rule detects winlogon.exe loading a DLL named kbdus1.dll, a keyboard-layout persistence technique used by Backdoor.Stupig to execute code as SYSTEM at logon. The legitimate keyboard file is kbdus.dll without the trailing digit.

Suspicious SearchIndexer Outbound Network Connection after Injection

This rule detects the Windows SearchIndexer process making outbound network connections to non local addresses. SolarMarker StellarInjector injects the SolarPhantom backdoor into SearchIndexer to run hVNC and stealer traffic from a trusted host. SearchIndexer should not initiate internet connections so this indicates code injection and C2.

Malicious EdgeStepper iptables DNS Redirection for Adversary-in-the-Middle

This rule detects iptables NAT PREROUTING rules that redirect outbound DNS traffic on destination port 53, a technique used by the PlushDaemon EdgeStepper implant on compromised network devices. Hijacking DNS at the gateway lets the actor perform adversary-in-the-middle interception and reroute update lookups to attacker infrastructure.

Suspicious COLDRIVER BAITSWITCH Execution via Rundll32 Verifyme Export (via process_creation)

This rule detects rundll32 invoking a DLL export named verifyme as used by the COLDRIVER ClickFix chain to run the BAITSWITCH loader from a remote share. Rundll32 calling this export is characteristic of the campaign.

Suspicious Installed Software Enumeration via Registry Uninstall Key Query

This rule detects recursive querying of the registry Uninstall keys via reg to enumerate installed software which the RM3 banking malware performed during host profiling as documented by NCC Group. Enumerating installed products helps operators fingerprint the victim and identify security tooling before further action.

Suspicious XLoader Persistence via Policies Explorer Run Registry Key (via registry_set)

This rule detects writes to the Policies Explorer Run registry key, a less-common autostart location XLoader uses with randomized value names derived from the username to persist its hollowed payload. Adversaries prefer this key over the standard Run key to evade autostart monitoring that focuses on CurrentVersion Run, making detection useful for surfacing stealthy persistence ahead of credential theft.