Sigma detection rules, expert-reviewed

Malicious Remote Script Piped to Shell via Curl (via process_creation)

This rule detects curl fetching a remote script and piping it directly into a shell interpreter, a common Linux and container compromise technique. Observed in the Elastic Security Labs TeamPCP container attack scenario where curl -fsSL of proxy.sh piped to bash bootstraps the intrusion and downloads further tooling.

Malicious ScreenConnect Client Installation via Msiexec (via process_creation)

This rule detects silent installation of the ScreenConnect client setup MSI, abused in the SILENTCONNECT campaign to deploy remote access tooling. Observed in Elastic Security Labs telemetry where msiexec installs ScreenConnect.ClientSetup.msi to give the adversary persistent hands-on-keyboard control.

Suspicious ClickFix PowerShell Execution with Hidden Window (via process_creation)

This rule detects PowerShell launched with an abbreviated hidden window style argument combined with string reconstruction, a pattern used by ClickFix clipboard lures delivering MIMICRAT. Observed in Elastic Security Labs telemetry where powershell -WInDo Min hides the console while string-slicing rebuilds the attacker domain to fetch the custom RAT.

Suspicious Office Application Spawning Interpreter via DDEAUTO (via process_creation)

This rule detects Microsoft Office applications spawning command shells or scripting interpreters, the hallmark of Dynamic Data Exchange DDEAUTO field abuse for code execution. Observed in Elastic Security Labs root cause analysis where winword.exe launches mshta, powershell, or cmd from a weaponized document to run attacker payloads.

Malicious Service ACL Tampering via Sc Sdset (via process_creation)

This rule detects use of sc sdset to rewrite a service security descriptor, hardening a malicious service against inspection or removal. Observed in the BADIIS SEO poisoning campaign analyzed by Elastic Security Labs where the WalletServiceInfo service ACL is tampered to protect the implant for defense evasion and persistence.

Suspicious Remote MSI Installation of RMM Tooling via Msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package hosted at a remote URL, a technique used after SolarWinds Web Help Desk exploitation to deploy remote monitoring and management tooling such as Velociraptor and cloudflared. Observed in Elastic Security Labs telemetry where quiet remote MSI installs establish attacker persistence and command channels.

Malicious Print Spooler Child Process Execution via PrintNightmare (via process_creation)

This rule detects the Windows print spooler service spawning command shells or scripting interpreters, a behavior consistent with exploitation of the PrintNightmare vulnerability CVE-2021-34527. Observed in Elastic Security Labs GOAD lab telemetry where spoolsv.exe launching unusual child processes indicates remote code execution as SYSTEM for privilege escalation.

Suspicious WMLOADER Masquerading as BDReinit Outside Install Path

This rule detects a process named BDReinit.exe running from a location other than a legitimate Bitdefender installation directory, the masquerading technique used by the WMLOADER component that deploys NANOREMOTE. Renaming the loader to a trusted security-product binary in an unexpected path helps it blend in while it reads its wmsetup.log configuration.

Suspicious Encoded PowerShell Execution with No Profile

This rule detects PowerShell launched with the -noprofile flag alongside an encoded command argument, the launcher pattern seen delivering the FORMBOOK payload dllhostSvc.exe. Combining profile suppression with base64-encoded commands is a common obfuscation used to hide the downloaded second stage.

Malicious Equation Editor Child Process Indicating Exploit

This rule detects the Microsoft Equation Editor eqnedt32.exe spawning any child process, which indicates successful exploitation of an Office document delivering the FORMBOOK stealer. The legitimate equation editor never launches other executables, so any child process is a high-confidence exploit signal.

Suspicious Child Process Spawned by IIS Worker Process w3wp

This rule detects the IIS worker process w3wp.exe spawning a command interpreter or scripting host, a strong indicator of web exploitation or webshell activity such as the ViewState deserialization abuse that delivered the TOLLBOOTH IIS module. Command shells launched from the web server are rarely legitimate.

Suspicious Secret Scanning with trufflehog Verified Results

This rule detects trufflehog being executed to scan the local filesystem for verified secrets and emit JSON output, the credential-harvesting behavior of the Shai-Hulud npm supply-chain worm. The worm runs trufflehog on compromised developer machines to collect cloud and registry tokens for further spread.

Suspicious Active Directory Database Theft via ntds.dit Access

This rule detects command lines that reference the ntds.dit Active Directory database alongside ntdsutil or volume shadow copy operations used to extract it. Copying ntds.dit from a domain controller yields the password hashes for every domain account.

Malicious LSASS Memory Dump via procdump

This rule detects procdump being run against the lsass.exe process to capture a full memory dump, from which credentials can be extracted offline with tools such as mimikatz. This is one of the most common OS credential-dumping techniques.

Malicious Registry Hive Dump via reg save of SAM SYSTEM SECURITY

This rule detects reg.exe being used to export the SAM, SYSTEM, or SECURITY registry hives to disk, a classic offline credential-dumping step. Attackers copy these hives to extract local account password hashes and LSA secrets away from the live system.