Sigma detection rules, expert-reviewed

Malicious Ladon PowerShell Attack Framework Import (via process_creation)

This rule detects PowerShell importing the Ladon attack framework module and invoking its modules such as SweetPotato, Runas, or MssqlCmd as observed in the MeshAgent and SuperShell intrusion. Ladon provides scanning, privilege escalation, and lateral movement capabilities.

Suspicious Fscan Internal Network Scanner Execution (via process_creation)

This rule detects execution of the fscan network scanner with host file and silent output options as observed in the MeshAgent and SuperShell intrusion. Fscan is used by the actor to enumerate internal hosts and open ports for lateral movement.

Suspicious Browser History Wipe via Rundll32 ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to clear browser history and cache as used by the HiddenGh0st malware to remove traces. This indicator flag combination erases stored browsing artifacts on the host.

Suspicious CRAT Injection Named Pipe ChromeUpdatePipe (via pipe_created)

This rule detects the creation of the named pipe ChromeUpdatePipe used by the CRAT payload to transmit injected code between processes. The pipe masquerades as a Chrome update channel and is a stable indicator of this backdoor family.

Suspicious Xctdoor Script Dropper Staging in Public Videos Folder (via file_event)

This rule detects the creation of VBS, BAT, or PS1 launcher and downloader scripts inside the Public Videos directory, a staging location used by the Xctdoor infection chain. Script files in this path are highly unusual for normal user activity.

Suspicious Larva-24009 Keylogger Log Staging in OneDrive Path (via file_event)

This rule detects the creation of keylogger output files named log.log or logv.log under the ProgramData Microsoft OneDrive directory as observed in the Larva-24009 campaign. The use of an OneDrive named folder under ProgramData for keystroke capture is a strong indicator of this actor.

Suspicious AtlasRAT Loader Artifacts in Public Documents (via file_event)

This rule detects the creation of AtlasRAT loader components such as Wxfun.dll, offline.ini, and MODIf.html in the Public Documents directory. These filenames and location are used by the AtlasRAT in-memory loader chain to stage and inject the RAT.

Suspicious Kimsuky Python Backdoor Staging in Winii Directory (via file_event)

This rule detects the creation of the Python backdoor beauty.py or its norton.db scheduler definition inside the C winii directory as used by the Kimsuky LNK campaign. This hidden staging path and filename set are distinctive to the backdoor deployment.

Suspicious T-Rex CoinMiner Binaries in Windows NT Program Files Folder (via file_event)

This rule detects the creation of T-Rex CoinMiner executables such as mmc.exe, mtn.exe, syc.exe, syn.exe, or tnt.exe inside a Windows NT folder under Program Files x86 as used in the internet cafe mining campaign. Placing miner binaries under a fake Windows NT directory is a masquerading technique.

Suspicious Malicious IIS Module DLL Written to Inetsrv Directory (via file_event)

This rule detects the creation of a caches.dll file within the System32 inetsrv directory as used by the Larva-25003 IIS malware to host its native module. Dropping a new DLL into the inetsrv module directory is an unusual event outside of IIS feature installation.

Malicious Privileged Container Creation in Kubernetes (via audit)

This rule detects a Kubernetes API request that creates a pod with a privileged security context, which grants the container near-host capabilities and is a primary path for escaping to the underlying node. Container escape and privileged workloads are emerging techniques in the Red Canary Threat Detection Report as adversaries target cloud-native environments. Detecting privileged pod creation surfaces a high-risk configuration that enables host compromise.

Malicious Assignment of a Privileged Azure AD Role (via auditlogs)

This rule detects an account being added to a privileged Azure AD directory role such as Global Administrator or Privileged Role Administrator, an account-manipulation technique used to escalate and entrench control of a tenant. Privileged role assignment is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces privilege escalation in the identity plane.

LaunchAgent or LaunchDaemon Persistence File Creation on macOS (via file_event)

This rule detects creation of a property list in a LaunchAgents or LaunchDaemons directory, the primary autostart persistence mechanism on macOS that adversaries and stealers abuse to survive reboots and re-launch their payload. macOS persistence via launch items appears in the Red Canary Threat Detection Report. Detecting new launch-item plists surfaces persistence as it is installed, particularly outside of normal software installs.

EAP Service Activation by Liontail Framework for DLL Sideloading - Via Command (via process_creation)

This rule detects enable the Eaphost component in order to perform a DLL sideloading attack.

Suspicious Commonly-Hijacked DLL Loaded From a User-Writable Path (via image_load)

This rule detects a process loading a frequently search-order-hijacked system DLL name from a user-writable directory such as AppData, Temp or ProgramData, indicating DLL search-order hijacking where an attacker-planted DLL is loaded instead of the legitimate one. DLL hijacking is a persistent defense-evasion and persistence technique in the Red Canary Threat Detection Report. Detecting these known-abused DLL names loading from non-system paths surfaces the hijack.