Sigma detection rules, expert-reviewed

Suspicious Secret Scanning with trufflehog Verified Results

This rule detects trufflehog being executed to scan the local filesystem for verified secrets and emit JSON output, the credential-harvesting behavior of the Shai-Hulud npm supply-chain worm. The worm runs trufflehog on compromised developer machines to collect cloud and registry tokens for further spread.

Suspicious Active Directory Database Theft via ntds.dit Access

This rule detects command lines that reference the ntds.dit Active Directory database alongside ntdsutil or volume shadow copy operations used to extract it. Copying ntds.dit from a domain controller yields the password hashes for every domain account.

Malicious LSASS Memory Dump via procdump

This rule detects procdump being run against the lsass.exe process to capture a full memory dump, from which credentials can be extracted offline with tools such as mimikatz. This is one of the most common OS credential-dumping techniques.

Malicious Registry Hive Dump via reg save of SAM SYSTEM SECURITY

This rule detects reg.exe being used to export the SAM, SYSTEM, or SECURITY registry hives to disk, a classic offline credential-dumping step. Attackers copy these hives to extract local account password hashes and LSA secrets away from the live system.

Suspicious Wireless Credential Theft via netsh wlan Key Export

This rule detects netsh being used to display saved wireless profiles with cleartext keys, a credential-harvesting step performed by NOVABLIGHT. Exporting stored Wi-Fi passwords in the clear gives adversaries reusable network credentials.

Suspicious Chrome Launch with Remote Debugging for Credential Theft

This rule detects a Chromium-based browser launched with a remote debugging port or pipe argument, a technique used by EddieStealer and similar infostealers to drive the browser over the DevTools protocol and extract saved passwords and cookies. Remote debugging flags are rarely set by end users and indicate automated browser credential theft.

Suspicious Python Loader Execution from Public Directory

This rule detects a Python interpreter executing an __init__.py loader from a user Public directory, the staging pattern used in the DPRK Bit-By-Bit intrusion to run a malicious YAML deserialization payload. Python execution from a shared Public path is atypical and indicates malware staging and execution.

Suspicious PowerShell Encoded Command Execution

This rule detects powershell.exe or pwsh.exe invoked with an encoded command parameter, a technique used to obfuscate scripts and command-and-control instructions during post-exploitation and exfiltration. Encoded commands hide intent from casual inspection and are frequently abused by malware and offensive frameworks.

Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility

This rule detects a Java process spawning a shell or file-download utility, a post-exploitation pattern following Log4Shell (CVE-2021-44228) JNDI injection where the vulnerable Java application executes attacker commands to retrieve secondary payloads such as Mozi. Java processes launching wget, curl, or a shell warrant investigation for remote code execution.

Suspicious Process Execution from Hidden Outlaw Config Directory

This rule detects execution of binaries or scripts from a hidden .configrc directory in a user home path, the staging location used by the Outlaw Linux malware for its miner and SHELLBOT components. Execution from a hidden dotfile directory indicates malware masquerading its payloads within user configuration folders.

Suspicious File Immutability via chattr

This rule detects use of the chattr utility to set the immutable or append-only attribute on files, a technique used by the Outlaw Linux malware to protect its persistence components such as SSH authorized_keys and cron entries from removal. Attacker use of chattr locks defensive tooling out of remediating implanted files.

Malicious Cryptocurrency Miner Masquerading as kswapd0

This rule detects a userland process named kswapd0 executing from disk, a masquerade used by the Outlaw Linux malware to hide XMRig cryptocurrency mining under the name of a legitimate Linux kernel thread. Because kswapd0 is a kernel thread that never appears as an on-disk executable, such a process strongly indicates cryptojacking for resource hijacking.

Possible GTFOBins Shell Breakout via Unix Utilities

This rule detects common Unix utilities such as env, awk, busybox, and mysql spawning an interactive shell, a GTFOBins pattern used to break out of restricted environments or abuse sudo privileges. These utilities spawning /bin/sh or /bin/bash is atypical and indicates a shell-evasion attempt by an insider or intruder.

Suspicious runas NETONLY for Access Token Manipulation

This rule detects use of runas with the netonly flag, an access token manipulation technique detailed by Elastic where new network credentials are applied without validating them locally. Attackers use this to run tools under alternate credentials for lateral movement while the local session identity is unchanged. Interactive netonly logons outside of administrative jump host workflows can indicate credential abuse.

Suspicious GRUB Bootloader Script Modification for Bootkit Persistence

This rule detects shell modification of GRUB bootloader scripts under /etc/grub.d, a pre-OS persistence technique from the Elastic Linux persistence grand finale. Injecting commands into GRUB configuration lets an attacker gain execution before the operating system loads for stealthy and resilient persistence. Direct edits to these scripts outside of kernel or bootloader updates should be examined.