Sigma detection rules, expert-reviewed

Suspicious High Frequency Scheduled Task Creation via Schtasks

This rule detects creation of a scheduled task configured to run every few minutes which the TorNet backdoor uses to repeatedly relaunch its loader under a randomized task name. Minute interval recurring tasks are unusual for legitimate software and indicate persistence with frequent re execution.

Malicious UNC3944 Microsoft Defender Real-Time Protection Disable via Set-MpPreference (via ps_script)

This rule detects PowerShell invoking Set-MpPreference to disable Microsoft Defender real-time and behavior monitoring protections. UNC3944 disabled endpoint defenses this way to enable follow-on ransomware and tooling deployment after gaining access through SIM-swap and SMS phishing. Turning off real-time protection is a strong pre-encryption defense-evasion signal.

Malicious Windows Native Backup Size Re-configuration (via process_creation)

This rule detects delete existing Windows native backup by reducing the allocated backup storage.

TamperedChef Persistence via PDFEditorUpdater Run Key (via registry_set)

This rule detects the TamperedChef infostealer establishing autostart persistence through a PDFEditorUpdater Run key whose value invokes the PDF Editor binary with its hidden update flag. Adversaries use this key to relaunch the weaponized editor at logon, making detection of the registry write useful for catching persistence before credential theft resumes.

Suspicious SharePoint Webshell File Creation in LAYOUTS Directory via ToolShell (via file_event)

This rule detects creation of known ToolShell webshell and key harvester aspx files inside the SharePoint LAYOUTS directory. These filenames are associated with post exploitation of CVE-2025-53770 and related SharePoint flaws.

Malicious Replication Privileges Granted to Perform DCSync Attack (via security)

This rule detects grants replication privilege to an account to exflitrate Active Directory credentials.

Suspicious TimbreStealer Execution via rundll32 iernonce.dll (via process_creation)

This rule detects rundll32.exe loading iernonce.dll, the module executed via a run-once mechanism by the TimbreStealer information stealer targeting Mexican users. The stealer proxies its execution through rundll32 to evade defenses while collecting browser credentials.

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

This rule detects Kubernetes API server requests authenticated as system:anonymous or belonging to the system:unauthenticated group. Adversaries query an unauthenticated API server to enumerate pods, secrets, and other cluster resources for reconnaissance and initial access. Anonymous access to the control plane indicates a misconfigured cluster exposed to untrusted callers.

Suspicious Windows Terminal Launching Hidden PowerShell with Execution Bypass (via process_creation)

This rule detects Windows Terminal (wt.exe) launching a hidden PowerShell instance with an execution policy bypass and a script file argument, a chain observed in the North Korea-nexus compromise of the Axios NPM package where a postinstall script dropped and ran a PowerShell payload. Adversaries use this to execute code stealthily while bypassing script controls, which makes it valuable for catching supply-chain-driven execution.

Malicious NetSupport RAT Masquerading as systeminfo.exe

This rule detects a process named systeminfo.exe loading a client32.ini configuration file, which is the EVALUSION NetSupport RAT masquerading as the benign Windows utility. The RAT was delivered inside a JPG-wrapped ZIP and run as systeminfo.exe alongside its client32.ini config. The legitimate systeminfo tool never reads a NetSupport config, so this name-and-context mismatch reveals the RAT.

Suspicious Credential Search via findstr for Password Strings (via process_creation)

This rule detects findstr executed to search files for the keyword password. The Lumma infostealer uses findstr to locate plaintext credentials stored in local files, harvesting secrets for exfiltration and follow-on account compromise.

Suspicious Kimsuky Wscript Launch From Hidden Windirr Directory (via process_creation)

This rule detects wscript.exe executing a VBS script from the hidden C windirr directory created by the Kimsuky LNK based Python backdoor chain. The staging folder name and background VBS execution are unique markers of this campaign.

Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)

This rule detects an Image File Execution Options Debugger value being registered for the sticky keys binary sethc.exe, a persistence and privilege-escalation backdoor used by Phobos affiliates. The technique launches an attacker command interpreter from the logon screen without authentication.

Suspicious DLL Sideloading via csmonitor.exe Loading Microsoft.ServiceHosting.Tools.dll (via image_load)

This rule detects the QuickFox supply chain implant loading a trojanized Microsoft.ServiceHosting.Tools.dll through the legitimate Azure Compute Emulator binary csmonitor.exe. The FDMTP loader relies on DLL search order hijacking to run inside a trusted signed process. Loading this Azure tooling DLL outside its normal SDK context is highly anomalous.

Malicious SparrowDoor Process Hollowing of colorcpl.exe

This rule detects execution of the legitimate colorcpl.exe utility with the numeric command line argument 11, a pattern used by the FamousSparrow group to launch a hollowed process hosting the SparrowDoor backdoor. colorcpl.exe is a color management applet that does not normally accept such arguments, so this invocation indicates process hollowing for defense evasion.