Sigma detection rules, expert-reviewed

Suspicious Web Service Spawning Bash Reverse Shell on Ivanti via Exploitation

This rule detects the Ivanti Connect Secure uwsgi web process spawning a Bash shell that reads a staged payload from a temporary path. This chain was uncovered through memory forensics of exploited Ivanti Connect Secure appliances. Web service processes launching interactive shells indicate successful remote code execution.

Suspicious Security Software Discovery via tasklist and findstr (via process_creation)

This rule detects tasklist output piped into findstr to search for antivirus process names such as Bitdefender, ESET, Quick Heal and Sophos. The Lumma infostealer enumerates running security products this way to fingerprint defenses and adjust its behavior before credential theft.

Suspicious Active Directory Computer Export via csvde (via process_creation)

This rule detects csvde.exe exporting Active Directory computer objects with an objectClass=Computer filter, the reconnaissance step FIN7 used to enumerate hosts after MSIX-based access. csvde is rarely run interactively and an LDAP export of computer accounts maps the environment for lateral movement. This preceded NetSupport RAT and DiceLoader deployment.

Suspicious Security Process Enumeration via Tasklist And Findstr

This rule detects tasklist output piped through findstr to enumerate running processes, a discovery step CrazyHunter ransomware uses to locate security and endpoint tooling before disabling it. Filtering the process list for defensive products lets the operator plan evasion or termination. Chaining tasklist with findstr is uncommon in normal administrative use.

Possible F5 iControl REST Remote Code Execution via Util Bash Endpoint

This rule detects POST requests to the F5 iControl REST util bash endpoint which grants arbitrary command execution when reached after the SSRF authentication bypass of CVE-2021-22986 documented by NCC Group. Access to this endpoint by an unauthenticated actor indicates full appliance compromise.

Malicious Event Log Clearing via wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensic step used by The Gentlemen ransomware operators to erase traces. Clearing logs destroys the evidence needed to reconstruct intrusion activity. This is a strong defense-evasion indicator on servers and workstations.

Suspicious Kubernetes Secret and Permission Enumeration via kubectl (via process_creation)

This rule detects kubectl invocations that enumerate permissions or read secrets, matching reconnaissance from the Hell's Keychain supply-chain research on IBM Cloud Databases for PostgreSQL. Attackers list allowed actions and dump secrets to find credentials for lateral movement. Broad secret enumeration from an unexpected principal is a strong discovery indicator.

Suspicious Privileged Docker Container Launch With Host chroot

This rule detects a docker run command started with the privileged flag combined with a chroot into the host filesystem. Attackers abusing exposed Docker API port 2375 deploy Alpine containers with docker run --privileged and chroot to break out onto the host and execute malware. Privileged container launches that immediately chroot to the host are a strong container-escape indicator.

Malicious dnscat2 DNS Tunneling C2 Traffic

This rule detects DNS queries containing the dnscat marker string used by the dnscat2 tunneling tool. It maps to command-and-control and data exfiltration over DNS where an operator encodes traffic in oversized MX and TXT lookups to evade network controls. Detecting the dnscat pattern surfaces DNS-based C2 beaconing.

MSSQL Server Process Spawning Command Shell via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning cmd.exe or PowerShell, the direct signature of xp_cmdshell abuse on an exposed database server. Huntress observed operators chaining bcp data staging and local account creation from this shell during MSSQL intrusions. A database engine launching command interpreters is not normal behavior and indicates code execution through the SQL layer.

Suspicious 0ktapus Phishing Kit Credential Post Path Access

This rule detects web requests to the /login/email and /login/identifier endpoints combined with the Poll.js resource which are DOM and URL fingerprints of the 0ktapus phishing kit that impersonates Okta and single sign-on portals. This is important because these paths are hardcoded artifacts of the kit used to harvest credentials and multi-factor codes so their presence in proxy logs indicates a user interacting with a 0ktapus phishing site.

Malicious LSASS Credential Dump via SilentProcessExit WerFault Abuse

This rule detects registry modifications under the Image File Execution Options SilentProcessExit or GlobalFlag keys for lsass.exe, the mechanism that forces WerFault.exe to write a full memory dump of the process. Adversaries abuse this Windows Error Reporting behavior to dump LSASS and extract credentials without a recognized dumping tool. These keys targeting lsass.exe have no legitimate use.

Suspicious macOS Persistence via launchctl submit (via process_creation)

This rule detects use of the legacy launchctl submit subcommand to register a background job for persistence. The JINX-0164 threat actor abused this mechanism to launch an implant under a masqueraded job label such as chrome.job. This technique lets attackers run code on login while blending in with legitimate agent labels.

Suspicious Winlogon Shell Persistence via Registry by Key Group

This rule detects modification of the Winlogon Shell value to something other than the default explorer.exe, a persistence technique used by Key Group ransomware to auto-run its payload at logon. Any non-default shell value on this key indicates hijacked user-session startup and should be investigated.

Suspicious Spectre Ops Staging in CullinetProgram Directory via file_event

This rule detects the Spectre Ops stealer staging files inside a CullinetProgram directory under AppData Roaming, which it pairs with a Startup folder entry for persistence. The uniquely named working directory holds the malware components between reboots. This distinctive folder name is not associated with legitimate software and reliably marks the stealer footprint on disk.