Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Masquerading as DockerDesktop

This rule detects creation of a scheduled task referencing DockerDesktop.exe as its action, matching the persistence used by the FakeAgent malvertising campaign to relaunch a .NET RAT. The task name and target impersonate Docker Desktop to appear benign among legitimate application tasks. Scheduled task persistence naming a DockerDesktop binary created via schtasks is a campaign indicator.

Malicious Remote Payload Piped to Shell via wget on PAN-OS

This rule detects a remote payload being downloaded with wget and piped directly into a shell interpreter, a technique used in Operation MidnightEclipse to fetch second-stage tooling after exploiting CVE-2024-3400. Piping downloaded content straight to bash leaves no file on disk and is a common in-memory execution pattern. Detecting this reveals remote code retrieval and execution on the appliance.

Malicious Local Account Creation Masquerading as krbtgt (via process_creation)

This rule detects creation of a local account named krtbgt via net.exe, a homoglyph masquerade of the krbtgt account used by Lazarus in Operation Blacksmith. The rogue account provides persistent authenticated access while imitating a well-known service identity.

Suspicious File Search for Passwords via Findstr (via process_creation)

This rule detects findstr being used to search files recursively for the string password, an unsecured-credentials technique for locating secrets in configuration files and scripts. Searching files for passwords is tracked in the Red Canary Threat Detection Report. Detecting these searches surfaces credential hunting across the file system.

Suspicious Firewall Rule Added for Masqueraded csrss Process via netsh

This rule detects netsh advfirewall creating a firewall rule referencing a csrss-named program. Bundled malware masquerades its payload as the system process csrss and allows it through the firewall to enable C2 traffic. Combining a system-process name with an attacker-created firewall rule is a strong evasion signal.

Malicious Fileless Execution via memfd Anonymous File on Linux Cloud Workload (via process_creation)

This rule detects a process whose executable path resolves to an in-memory memfd anonymous file, the fileless technique the PyLoose cryptomining attack used to run its XMRig payload from a Jupyter Notebook without touching disk. Attackers rely on memfd_create to evade file-based detection, so a process backed by a memfd descriptor on a cloud workload is highly suspicious.

Web Shell Written to ScreenConnect App_Extensions Directory

This rule detects aspx or ashx files written to the ScreenConnect App_Extensions directory, where post-exploitation of the authentication bypass drops server-side web shells for code execution. Huntress observed operators writing extension pages to this root after gaining admin access. Executable web content in this location is not part of normal product operation and signals web shell installation.

Malicious OysterLoader C2 Beacon Using WordPressAgent User Agent

This rule detects outbound web requests carrying the distinctive WordPressAgent FingerPrint user agent used by OysterLoader. The loader beacons to its command server with this hardcoded agent and reaches encrypted endpoints. A non browser user agent of this exact form is a high confidence network indicator of OysterLoader activity.

Suspicious Windows Service Trigger Configuration via Registry Modification

This rule detects creation or modification of service trigger information under the Services registry hive. Adversaries abuse service triggers to start otherwise disabled or on-demand services such as Remote Registry, WebClient, or EFS without direct start permissions, enabling stealthy persistence and privilege escalation.

Suspicious Run Key Persistence Launching Headless Conhost Node.js on EtherRAT Infection

This rule detects a Run key persistence value that chains conhost.exe with the --headless flag to silently launch the Node.js interpreter. This tradecraft is used by the EtherRAT SYS_INFO module to run its JavaScript backdoor without a visible console window. The headless conhost wrapper hides execution while maintaining autostart command and control.

SwimSnake AutoRecoverDat.dll Execution via rundll32 or regsvr32 (via process_creation)

This rule detects rundll32.exe or regsvr32.exe executing AutoRecoverDat.dll, the module the SwimSnake (Silver Fox) group drops into the user AppData Embarcadero folder to load shellcode and deploy the WinOS backdoor. Adversaries proxy execution of the malicious DLL through trusted signed binaries to evade application controls, making early detection critical for catching the loader before backdoor communication.

Suspicious System Process Name Executing From Non-System Path

This rule detects a process named csrss.exe or dllhost.exe running from a directory other than Windows System32. DCRAT in this campaign masqueraded as csrss.exe and dllhost.exe while executing from user-writable locations. Legitimate csrss and dllhost only run from System32 so execution from another path is a reliable masquerading indicator.

Suspicious Tycoon 2FA Credential Exfiltration Fields

This rule detects HTTP requests carrying the Tycoon 2FA exfiltration parameters bltdip, bltdref, bltdua and bltddata. These custom field names package the stolen victim context and session data sent back to the phishing kit, uniquely marking AiTM credential theft.

Suspicious PowerShell WebClient DownloadFile with Execution Policy Bypass (via process_creation)

This rule detects PowerShell launched with an execution policy bypass and a hidden window that instantiates Net.WebClient to call DownloadFile. This behavior was observed in the updated MATA campaign against industrial companies to stage additional payloads onto compromised hosts. Detecting this scripted download surfaces the ingress-tool-transfer stage of the intrusion.

Renamed Nimbus Manticore Stager Execution with doit Argument from 2FAGuard Directory (via process_creation)

This rule detects the renamed setup.exe stager executed with the doit argument from the 2FAGuard working directory, the GUI-suppressing invocation Nimbus Manticore uses through its BackupCheck scheduled task to load the native main.dll payload directly. Adversaries leverage this argument to run the implant without the decoy interface, making detection useful for catching the persistence stage of the infection chain.