Sigma detection rules, expert-reviewed

Suspicious CMSTP Execution With INF Payload via process_creation

This rule detects the Connection Manager Profile Installer cmstp.exe running with an INF file or silent flag, the LOLBin abused in the GST-phishing Remcos RAT chain to bypass UAC and execute attacker code. Adversaries leverage the trusted, auto-elevating cmstp binary to run malicious INF-defined commands while evading application controls, so its rare invocation is a strong signal of the multi-stage .NET infection.

Linux Process Execution from /dev/shm Shared Memory Directory

Alerts on Linux processes executing binaries from /dev/shm, a common in-memory staging location.

Suspicious Malware Delivery via Discord CDN Attachment

This rule detects downloads of archive and executable payloads from the Discord content delivery network attachments path which criminal actors abuse to host and distribute malware. Because Discord is a widely trusted service this channel is frequently used to bypass reputation based controls for staging second stage payloads.

Malicious NTDS Database Dump via NTDSUtil in BlackSuit Ransomware

This rule detects ntdsutil being used to create an installation from media (IFM) copy of the Active Directory database, a credential-access technique observed in BlackSuit ransomware intrusions. Dumping NTDS.dit gives operators every domain hash for offline cracking and full domain compromise, making this a critical detection.

Suspicious Scheduled Task Persistence Masquerading as OneDrive Update

This rule detects creation of a scheduled task named OneDrive Update via schtasks that runs at very short intervals and at startup, the persistence used by the GigaWiper destructive backdoor. Impersonating the OneDrive updater lets the wiper relaunch frequently while blending into expected update activity.

Malicious Regsvr32 Loading a DLL From a Data Directory (via process_creation)

This rule detects regsvr32.exe registering a DLL located in ProgramData or a user AppData directory, the loader behavior Emotet and similar malware use to execute a dropped payload under a trusted binary. Regsvr32 execution of user-dropped DLLs is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loading from a staging directory.

Suspicious BumbleBee C2 URI Pattern (via proxy)

This rule detects outbound web requests to the BumbleBee command-and-control URI paths such as get_load, gate and gates. These fixed endpoint names are used by the loader to fetch tasks and payloads. Matching this beacon pattern surfaces infected hosts communicating with attacker infrastructure for tasking and payload delivery.

Uncommon Domain Trust Discovery via Nltest (via process_creation)

This rule detects nltest.exe being used to enumerate domain controllers and domain trust relationships, a discovery step that adversaries and loaders such as those profiled in the Red Canary Threat Detection Report run to understand the Active Directory environment before moving laterally. Because interactive nltest trust enumeration is uncommon on typical endpoints, it is a useful early indicator of hands-on-keyboard reconnaissance. Detecting these queries surfaces the adversary orienting inside the domain.

Suspicious Shell Spawned by Langflow Python Process (via process_creation)

This rule detects a Langflow Python process spawning a command shell or network utility. Such a child process is consistent with the reverse shell payloads used against CVE-2025-3248. A Langflow worker does not normally launch interactive shells.

Malicious Cryptominer Staging Files Dropped in tmp Directory

This rule detects references to hidden cryptominer staging files written under /tmp such as .solr, kdevtmpfsi, zzz and .ICEd-unix. These paths were used across the Summer 2023 cryptojacking campaigns tracked by Wiz Research to drop XMRig and CCminer payloads, and their presence indicates resource-hijacking activity on a compromised host.

Suspicious XMRig Cryptominer Execution on Linux

This rule detects execution of the XMRig Monero cryptominer identified by its characteristic mining pool and donate-level arguments which was deployed both UPX-packed and standard as post-exploitation payload following React2Shell CVE-2025-55182 compromises. Cryptominer execution on a workload host indicates resource hijacking for financial gain after successful exploitation.

Suspicious bitsadmin Download to AppData Temp via ClickFix Revenge Chain

This rule detects bitsadmin.exe performing a transfer that downloads a remote http resource into the user AppData or Temp directory, the payload retrieval step of the ClickFix campaign following a Windows Run dialog paste. bitsadmin used interactively to fetch executables into user writable folders is a well known living off the land download technique. This catches the staging of the second stage binary.

Suspicious File Download via certutil

This rule detects certutil.exe being used with URL-cache download arguments to retrieve remote files, a living-off-the-land technique used by RansomHub affiliates to stage tooling. certutil is not a general purpose downloader, so its use to fetch remote content commonly indicates ingress tool transfer by an adversary.

Suspicious Boot Configuration Change to Safeboot Minimal via bcdedit

This rule detects use of bcdedit to set the boot configuration to safeboot minimal, forcing the host to reboot into Safe Mode where most endpoint security agents do not load. The ToyMaker intrusion used this to disable protections before hands-on-keyboard activity, so it is a high-confidence defense-evasion signal preceding credential theft or ransomware deployment.

Suspicious Active Directory Discovery via ADFind

This rule detects execution of the ADFind reconnaissance utility which Black Basta operators use to enumerate Active Directory users groups and computers during the discovery phase of an intrusion. While ADFind is a legitimate administrative tool its presence on endpoints is frequently associated with pre ransomware reconnaissance.