Sigma detection rules, expert-reviewed

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

This rule detects PowerShell adding Windows Defender exclusions or disabling real-time monitoring via Add-MpPreference or Set-MpPreference, a defense-evasion step used by malware delivered through MSIX installers per Red Canary. Attackers carve out exclusion paths so their staged payloads run unscanned, making unexpected exclusion changes a strong impairment-of-defenses signal.

Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)

This rule detects the MSIX StartingScriptWrapper.ps1 launching PowerShell from the WindowsApps directory, the installer-driven execution vector Red Canary tracked across multiple malware delivery campaigns. Legitimate apps rarely use this wrapper to run scripts, so its appearance signals a malicious MSIX package executing embedded PowerShell during installation.

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects whoami /all discovery executed under a Windows script host parent, the reconnaissance SocGholish performs immediately after its malicious JavaScript runs as emulated by Red Canary. Script hosts collecting user and privilege context are a hallmark of the SocGholish fake-update loader beginning hands-off enumeration of a new victim.

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

This rule detects the Backup Exec Remote Agent (beremote.exe) spawning a command shell, bitsadmin, or PowerShell, the exploitation chain Red Canary traced from a vulnerable backup service into hands-on-keyboard activity. Backup agents should not launch interpreters or download utilities, so this parentage strongly indicates the service was abused for initial access.

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

This rule detects WMIC being used to enumerate and delete Volume Shadow Copies, an inhibit-recovery step performed before encryption in the Confluence exploitation ransomware intrusion reported by Red Canary. Removing shadow copies prevents victims from restoring encrypted files, so this command is a strong precursor to imminent ransomware detonation.

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

This rule detects the Apache Tomcat process (which backs Confluence) spawning cmd.exe or powershell.exe, the post-exploitation behavior seen when adversaries exploited a Confluence vulnerability to deploy ransomware per Red Canary. A web application server launching a command interpreter almost always indicates successful remote code execution against the exposed service.

Suspicious Rundll32 Execution Without a DLL Reference via Process Creation (via process_creation)

This rule detects rundll32.exe executing without any .dll referenced on its command line, a pattern associated with Qbot (Qakbot) module loading as documented by Red Canary during the coordinated takedown. Legitimate rundll32 invocations almost always reference a DLL, so an execution lacking one is a strong indicator of injected or reflectively loaded malicious code worth investigating.

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

This rule detects a Google Workspace OAuth authorize event granting the Chrome Web Store management scope to a third-party application such as the Privacy Policy Extension app seen in this supply chain campaign. Attackers trick users into authorizing apps that can publish or modify Chrome extensions, enabling downstream compromise of every user who installs the affected extension.

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

This rule detects Entra ID sign-ins tied to the PerfectData Software and eM Client OAuth application identifiers that Red Canary observed adversaries abusing to gain persistent mailbox access during business email compromise schemes. Attackers consent these third-party mail applications into a compromised tenant so they can read and exfiltrate mail through issued tokens without the victim password, making any sign-in with these application IDs a strong compromise indicator.

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

This rule detects AWS STS GetCallerIdentity calls carrying a TruffleHog user agent, a validation step the Shai-Hulud worm performs against stolen access keys before exfiltration. Attackers confirm harvested cloud credentials are valid prior to abuse, so TruffleHog-attributed API activity in production accounts indicates credential theft and reconnaissance.

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

This rule detects successful NTLM network logons (Event 4624, logon type 3) originating from the workstation names DESKTOP-KRLUI3J and KALI. Rapid7 observed these workstation names during active exploitation of the SonicWall SMA1000 zero days CVE-2026-15409 and CVE-2026-15410 where the actor pivoted from the compromised appliance into the internal network. Kali-branded and attacker-named hosts authenticating over NTLM indicate lateral movement using stolen or bypassed credentials.

Suspicious Scheduled Task Creation With WebDAV Loader Task Names (via process_creation)

This rule detects creation of scheduled tasks named brokerhost or net_queue_32 through schtasks.exe. These task names were used for persistence in the exposed WebDAV malware delivery campaign analyzed by Rapid7. The distinctive task names combined with scheduled task creation indicate an attacker establishing automated re-execution of downloaded payloads.

Suspicious Remote File Download via certutil URLCache (via process_creation)

This rule detects certutil.exe downloading a file from a remote URL using the urlcache and split flags. Rapid7 observed this living-off-the-land download technique in an exposed WebDAV malware delivery lab used to pull additional tooling onto compromised hosts. certutil is a certificate utility and its use as a file downloader is a well-known ingress and defense evasion technique.

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

This rule detects chmod granting execute permission to shell scripts in /tmp followed by their execution through bash on a SonicWall SMA1000 appliance. This behavior was observed during in-the-wild exploitation of the CVE-2026-15409 and CVE-2026-15410 path traversal zero days where the actor staged post-exploitation payloads. Detecting it surfaces hands-on-keyboard code execution on an internet-facing appliance where interactive shell activity is otherwise abnormal.