Sigma detection rules, expert-reviewed

Malicious Remote Desktop Enablement via Netsh

This rule detects netsh enabling the Remote Desktop service in the firewall to open inbound RDP for lateral movement. This was observed during Obscura ransomware deployment. Opening RDP on hosts that normally block it extends the attacker foothold across the network.

Malicious Cloud Metadata Credential SSRF via HTTP (via proxy)

This rule detects HTTP requests to the cloud instance metadata IAM security credentials path on Linux hosts. Attackers exploiting the LMDeploy server side request forgery vulnerability coerced the inference engine into fetching temporary IAM credentials from the metadata service. Requests reaching the metadata credentials endpoint from an application server indicate credential theft through SSRF.

Suspicious NirSoft Credential Recovery Tools Execution

This rule detects execution of the NirSoft credential recovery tools netpass.exe and WebBrowserPassView.exe. The Christmas Miracle actor dropped these utilities to extract stored network and browser passwords. Their presence on a server indicates active credential harvesting by an intruder.

Malicious Discord RAT Module Download from GitHub via Proxy

This rule detects retrieval of Discord RAT plugin modules hosted on the public Discord-RAT-2.0 GitHub repository. The malware dynamically downloads and reflectively loads capability modules such as credential theft, webcam capture, and token stealers from this raw content path.

Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)

This rule detects PowerShell reading the registry Applications key for mshta under the software classes hive using wildcarded paths, a lookup PEAKLIGHT performs to locate mshta for proxy execution. Programmatic resolution of the mshta binary path is an anti-analysis and living-off-the-land staging behavior.

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

This rule detects the command shell pattern used by Cobalt Strike's getsystem, in which cmd.exe echoes data into a named pipe to trigger SYSTEM token impersonation via a briefly created service. Cobalt Strike is among the most prevalent adversary tools in the Red Canary Threat Detection Report, and this privilege-escalation primitive is a high-fidelity signal of an active beacon. Detecting the echo-to-pipe command surfaces hands-on escalation.

Possible AppDomainManager Hijack via Application Config File (via file_event)

This rule detects creation of an update.exe.config application configuration file used by Screening Serpens for AppDomainManager injection with ETW disabled. The malicious config forces the .NET runtime to load an attacker assembly and blinds Event Tracing for Windows.

Suspicious PAN-OS GlobalProtect Portal Font Staging File Creation

This rule detects creation of the Latte-Regular.woff file under the GlobalProtect portal fonts directory which Wiz identified as a staging artifact used during exploitation of the PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474. This is important because attackers wrote this specific web font path to stage payloads on the appliance so its appearance signals that the firewall has been compromised and is being prepared for follow-on tooling.

Suspicious ETW Bypass via PSEtwLogProvider Patching (via ps_script)

This rule detects PowerShell script content that reaches into the PSEtwLogProvider internal enabled flag to disable Event Tracing for Windows, an in-memory logging evasion used by the SEO poisoning infostealer. Patching this field blinds PowerShell script block telemetry. Legitimate scripts do not manipulate this private ETW provider field.

Renamed Execution of a Renamed Windows System Utility (via process_creation)

This rule detects a built-in Windows system utility running under a filename that does not match its embedded original binary name, exposing a mismatch between the PE OriginalFileName and the on-disk image. Renaming trusted utilities such as cmd, powershell, certutil or rundll32 is a defense-evasion technique highlighted in the Red Canary Threat Detection Report that lets adversaries slip past name-based detections and application controls. Alerting on the OriginalFileName-to-image mismatch surfaces the evasion regardless of the alias chosen.

Suspicious Expensive LDAP Query Reconnaissance

This rule detects Directory Service event 1644 recording expensive or inefficient LDAP search queries against a domain controller. This behavior matches LDAP-based reconnaissance where attackers issue broad filters to enumerate users, groups, and computers. A burst of expensive LDAP queries from unusual sources indicates active directory enumeration and should be correlated with the requesting host.

Suspicious Bitsadmin Transfer of CoinMiner Archive (via process_creation)

This rule detects bitsadmin.exe transferring a remote archive to download the XMRig CoinMiner as observed in the MS-SQL intrusion. Bitsadmin transfer jobs pulling zip payloads from external hosts are a known living off the land ingress technique.

Suspicious Deno Runtime Execution of Remote JavaScript Payload (via process_creation)

This rule detects the Deno JavaScript runtime executing a payload retrieved from a remote HTTP or HTTPS URL, the second stage of a ClickFix campaign that abuses the Deno runtime to deliver an infostealer. Legitimate use of Deno to run code directly from a remote web address on an endpoint is uncommon.

Suspicious NSSM Service Installation via process_creation

This rule detects the Non-Sucking Service Manager nssm.exe being used with the install argument to register an arbitrary program as a Windows service. Head Mare and Twelve used nssm to install persistence for masqueraded tunneling tools such as rclone and gost. Because nssm is not a default Windows binary its use to install services is a strong persistence signal.

Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation

This rule detects an IIS worker process spawning cmd or PowerShell that runs base64 encoded payloads, behavior observed during active exploitation of Gladinet CentreStack and Triofox local file inclusion flaws. Attackers leverage the web application context to achieve remote code execution and stage further tooling. Web servers rarely spawn encoded interpreters, so this indicates likely post-exploitation activity.