Sigma detection rules, expert-reviewed

Suspicious PowerShell WebClient DownloadFile with Execution Policy Bypass (via process_creation)

This rule detects PowerShell launched with an execution policy bypass and a hidden window that instantiates Net.WebClient to call DownloadFile. This behavior was observed in the updated MATA campaign against industrial companies to stage additional payloads onto compromised hosts. Detecting this scripted download surfaces the ingress-tool-transfer stage of the intrusion.

Renamed Nimbus Manticore Stager Execution with doit Argument from 2FAGuard Directory (via process_creation)

This rule detects the renamed setup.exe stager executed with the doit argument from the 2FAGuard working directory, the GUI-suppressing invocation Nimbus Manticore uses through its BackupCheck scheduled task to load the native main.dll payload directly. Adversaries leverage this argument to run the implant without the decoy interface, making detection useful for catching the persistence stage of the infection chain.

Possible MOVEit Transfer SQL Injection via X-siLock-SessVar Header

This rule detects requests to the MOVEit Transfer guestaccess endpoint carrying an X-siLock-SessVar header with SQL injection syntax, matching the header-driven SQLi documented by Assetnote for CVE-2023-34362. Attackers set session variables through this header to inject into backend queries and stage remote code execution. The endpoint and header combination indicates targeted injection rather than benign guest access.

Masquerading Machine-Like Local Admin Account Creation Ending With Dollar Sign (via process_creation)

This rule detects creation of a local account whose name ends with a dollar sign, a masquerading technique from the Truesec intrusion where operators created admin accounts mimicking machine accounts to blend into directory listings. Adversaries use dollar-suffixed names to hide backdoor accounts, making creation of such an account a focused persistence indicator.

Suspicious Entra Sign-In to OfficeHome with axios User Agent

This rule detects a successful Entra ID sign-in to the OfficeHome application where the user agent contains axios, an automation library used by the Tycoon 2FA adversary-in-the-middle platform. Tycoon 2FA relayed intercepted credentials and stolen session cookies through scripted axios clients to authenticate as the victim. A non-browser axios agent completing sign-in to OfficeHome indicates automated session token replay from an AiTM phishing kit.

Suspicious PowerShell Download to Public Libraries Folder (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download payloads into the Public Libraries staging directory. This behavior was observed in the MULTI#STORM campaign delivering Warzone and Quasar RAT payloads.

Malicious Veeam Credential Extraction via sqlcmd (via process_creation)

This rule detects use of sqlcmd to query the VeeamBackup Credentials table directly from the backup database. Akira ransomware operators extracted stored Veeam credentials this way to move laterally and destroy backups before encryption.

Suspicious Recursive icacls Grant of Full Access to Everyone via process_creation

This rule detects icacls granting the Everyone group full control over a directory tree recursively and quietly, a technique used by WannaCry ransomware to keep its dropped files accessible. The /T /C /Q flags silently apply permissions across all subdirectories. While administrators may occasionally adjust permissions this exact combination is strongly associated with malware staging.

MintsLoader Stage-Two C2 Beacon via htr.php Key and Campaign Parameters (via proxy)

This rule detects MintsLoader stage-two command-and-control beacons that request the htr.php endpoint with key, host id, and campaign parameters against DGA-generated domains. Adversaries leverage this structured request to fetch the next-stage payload keyed to the infected host, making the endpoint-and-parameter combination a strong C2 indicator.

Suspicious AWS CloudTrail Logging Disabled

This rule detects API calls that stop or delete AWS logging such as StopLogging, DeleteTrail and DeleteFlowLogs. Adversaries disable CloudTrail and VPC flow logs to blind defenders before carrying out further actions, a defense evasion step that should be rare and deliberate.

Malicious Windows Defender Exclusion of Drive Roots via Add-MpPreference (via process_creation)

This rule detects a PowerShell Add-MpPreference command adding whole drive roots as Windows Defender scan exclusions, an impairment step the 8220 Gang cryptomining campaign runs before dropping miner payloads. Excluding entire drives blinds antivirus across the system. Detecting broad exclusion-path additions surfaces defense evasion that precedes cryptominer deployment.

Possible Bitbucket Pre-Auth RCE via git archive Spawning Shell (CVE-2022-36804) (via process_creation)

This rule detects the git process spawning a shell interpreter as a child on a Bitbucket server host. This maps to CVE-2022-36804 exploitation where git archive with an injected --exec argument executes /bin/bash. Such a parent-child relationship indicates unauthenticated command execution rather than normal repository operations.

Suspicious ShadowGuard Rootkit Hidden Artifacts via swsecret Files (via file_event)

This rule detects creation of the swsecret_config.txt and swsecret_data artifacts used by the ShadowGuard rootkit to store hidden configuration and data in the Shadow espionage campaigns. These named files back the rootkit hiding logic, so their appearance on disk indicates rootkit deployment.

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

This rule detects setcap granting effective inheritable and permitted file capabilities such as cap_sys_admin to an executable, the step the GameOverlay Ubuntu OverlayFS exploit CVE-2023-2640 and CVE-2023-32629 uses to smuggle privileged capabilities across a copy-up. Assigning powerful capabilities to non-root executables is a strong local privilege escalation indicator.

Suspicious Aimmy Cheat Loader Executing Renamed LuaJIT Launcher via process_creation

This rule detects the trojanized Aimmy game cheat that uses Aimmy.bat to launch AimmyLauncher.exe, a renamed LuaJIT interpreter which executes malicious Lua bytecode. The threat abuses a signed scripting engine to run attacker supplied Lua while posing as a gaming aimbot. Flagging the batch launcher and the renamed interpreter surfaces the living off scripting execution chain before the bytecode payload runs.