Sigma detection rules, expert-reviewed

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

This rule detects AWS STS GetCallerIdentity calls carrying a TruffleHog user agent, a validation step the Shai-Hulud worm performs against stolen access keys before exfiltration. Attackers confirm harvested cloud credentials are valid prior to abuse, so TruffleHog-attributed API activity in production accounts indicates credential theft and reconnaissance.

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

This rule detects AWS CloudTrail activity carrying a TruffleHog user agent which indicates that a compromised or unauthorized IAM identity is being used to enumerate and validate secrets against the environment. Adversaries run TruffleHog with stolen credentials to confirm access and discover further secrets. Detecting this user agent surfaces credential reconnaissance in the cloud control plane.

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

This rule detects successful NTLM network logons (Event 4624, logon type 3) originating from the workstation names DESKTOP-KRLUI3J and KALI. Rapid7 observed these workstation names during active exploitation of the SonicWall SMA1000 zero days CVE-2026-15409 and CVE-2026-15410 where the actor pivoted from the compromised appliance into the internal network. Kali-branded and attacker-named hosts authenticating over NTLM indicate lateral movement using stolen or bypassed credentials.

Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)

This rule detects PowerShell invoking Invoke-Expression against the output of a DownloadString call. Rapid7 observed this in-memory download cradle in the exposed WebDAV malware delivery lab to fetch and execute remote script content without touching disk. Combining a remote download with immediate execution is a hallmark of fileless payload delivery.

Suspicious Scheduled Task Creation With WebDAV Loader Task Names (via process_creation)

This rule detects creation of scheduled tasks named brokerhost or net_queue_32 through schtasks.exe. These task names were used for persistence in the exposed WebDAV malware delivery campaign analyzed by Rapid7. The distinctive task names combined with scheduled task creation indicate an attacker establishing automated re-execution of downloaded payloads.

Suspicious Remote File Download via certutil URLCache (via process_creation)

This rule detects certutil.exe downloading a file from a remote URL using the urlcache and split flags. Rapid7 observed this living-off-the-land download technique in an exposed WebDAV malware delivery lab used to pull additional tooling onto compromised hosts. certutil is a certificate utility and its use as a file downloader is a well-known ingress and defense evasion technique.

Suspicious WebDAV Retrieval via rundll32 and davclnt.dll (via process_creation)

This rule detects rundll32.exe loading davclnt.dll to retrieve content from a remote WebDAV share. This technique was observed in an exposed WebDAV malware delivery lab analyzed by Rapid7 where a search-ms URI pointed victims to a remote WebDAV host to stage follow-on payloads. WebDAV retrieval through the DAV mini-redirector is rarely used by legitimate software and often signals staged malware delivery.

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

This rule detects chmod granting execute permission to shell scripts in /tmp followed by their execution through bash on a SonicWall SMA1000 appliance. This behavior was observed during in-the-wild exploitation of the CVE-2026-15409 and CVE-2026-15410 path traversal zero days where the actor staged post-exploitation payloads. Detecting it surfaces hands-on-keyboard code execution on an internet-facing appliance where interactive shell activity is otherwise abnormal.

Suspicious DLL Sideload of profiler16.dll (via image_load)

This rule detects the loading of profiler16.dll which was sideloaded through a renamed discord-rpc.x64.dll host binary in the WebDAV malware delivery campaign analyzed by Rapid7. Abusing a legitimately signed application to load an attacker-supplied DLL lets malicious code execute under the guise of a trusted process. Sightings of this DLL name loading into memory indicate active DLL search order hijacking.

Suspicious Internet Shortcut URL File Registered for Run Key Persistence (via registry_set)

This rule detects a Run key persistence value pointing to an internet shortcut .url file. The Sosano backdoor orchestrator wrote a .url file into the registry Run key so the shortcut relaunched the malware at each logon.

Suspicious Node.js Execution from User AppData Directory (via process_creation)

This rule detects the Node.js interpreter running from a user AppData Local path, a location TA584 used to execute the Tsundere bot outside standard install directories. Legitimate Electron applications can also run node from AppData so tune to environment.

Suspicious RegSvcs Execution Spawned by Script Interpreter for Process Hollowing (via process_creation)

This rule detects the .NET RegSvcs.exe utility launched by a script interpreter, an unusual parentage TA584 abused to hollow RegSvcs in a suspended state and inject the XWorm payload.

Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)

This rule detects mshta.exe spawning a hidden-window PowerShell process, a chain TA584 used for boot persistence via a WScript.Shell one-liner that decodes a remote Base64 script on each logon.

Suspicious OpenWith Process Spawned by Script Host for Code Injection (via process_creation)

This rule detects OpenWith.exe launched by PowerShell or MSBuild, an unusual parentage abused by Amatera Stealer as an Early Bird injection target. The stealer started OpenWith in a suspended state and hijacked its thread context to run shellcode.

Malicious MSBuild Execution of Downloaded csproj Project File (via process_creation)

This rule detects MSBuild.exe compiling a csproj file when launched by a script interpreter rather than a developer tool. Amatera Stealer ClickFix chains downloaded a csproj payload and executed it through the trusted MSBuild binary.