Sigma detection rules, expert-reviewed

Malicious Scheduled Task MicrosoftsUpdate Loading DLL Web Shell (via process_creation)

This rule detects creation of a scheduled task named MicrosoftsUpdate via schtasks. In the HrServ APT web shell intrusion the actor registers a task with this masquerading name to load hrserv.dll for persistence, so this misspelled Microsoft-lookalike task name indicates the malicious loader being installed.

Suspicious LocalAccountTokenFilterPolicy Registry Modification

This rule detects modification of the LocalAccountTokenFilterPolicy value, which disables remote UAC filtering so local admin accounts retain full privileges over the network. Play ransomware operators set this to ease lateral movement.

Suspicious File Based C2 Relay via Python Web Panel via process_creation

This rule detects the file based command and control component of the AI assisted intrusions where python3 runs a relay.py or webpanel.py operator panel that dispatches commands through /tmp/cmd_ FIFO files. This lightweight Python relay brokers attacker instructions to the implant on the host. Running these operator scripts from a compromised server is a strong indicator of hands on keyboard control.

Suspicious UNC3944 Rogue Federated Identity Provider Added to Entra Tenant (via azure)

This rule detects Azure AD/Entra directory operations that configure or modify domain federation settings, which adds or alters a trusted identity provider. UNC3944 abused hybrid identity by registering a rogue federated IdP to forge SAML tokens and impersonate any user in the tenant. Unexpected federation trust changes are a high-value indicator of a Golden SAML style backdoor.

Malicious Kimsuky Run Key Autostart to desktop.ini.bak in Public Folder (via registry_set)

This rule detects a Run key persistence value pointing to a masqueraded desktop.ini.bak file under C:\Users\Public, a technique used by Kimsuky to autostart its VBS/PowerShell keylogger against Japanese targets. The abuse of a system-looking filename in a world-writable public path is intended to blend persistence into normal-looking artifacts.

Suspicious AWS STS Session Token and Role Chaining Abuse via CloudTrail (via aws)

This rule surfaces AWS STS GetSessionToken and AssumeRole activity that adversaries abuse to mint temporary credentials and chain roles for lateral movement, as detailed in Red Canary's analysis of AWS cloud account abuse. Because these APIs are also used legitimately, alerts should be correlated with the calling identity and source to spot role chaining that escalates access across the environment.

Suspicious File Immutability Set via chattr for Anti-Removal on Linux

This rule detects chattr setting the immutable attribute on a file, an anti-removal technique used by the PeerBlight Linux backdoor to protect its sshd-agent persistence from deletion. Making backdoor files immutable prevents defenders and admins from removing them without first clearing the attribute. Interactive chattr immutability changes on service files are uncommon and suspicious.

Suspicious macOS Privilege Escalation Piping Password to sudo

This rule detects a stored password being piped into sudo with the stdin flag, the non-interactive privilege escalation used by the AMOS stealer after harvesting a user password. Reading a captured password from a hidden file and feeding it to sudo grants root without a prompt. This scripted sudo pattern is characteristic of macOS stealer malware.

Malicious RCE Confirmation Markers from Offensive Agentic Tooling

This rule detects the VAPT confirmation markers and command placeholder that attackers wrap around executed commands when validating remote code execution with offensive agentic tooling built on stolen AI compute. The markers bracket command output so the automation can parse successful execution. Their appearance on hosts is a high-confidence sign of automated exploitation.

Suspicious AMSI Bypass via AmsiScanBuffer Patching (via ps_script)

This rule detects PowerShell script blocks that reference AmsiScanBuffer together with VirtualProtect, the combination used to patch the Antimalware Scan Interface in memory. This AMSI bypass technique disables in-memory scanning so obfuscated loaders delivering Agent Tesla and XWorm can execute undetected.

Malicious Chaos Ransomware Ransom Note and Encrypted Extension (via file_event)

This rule detects Chaos C++ ransomware writing the ransom note READ_IT.txt into the AppData folder and appending the .chaos extension to encrypted files. Creation of these artifacts indicates active encryption by the locker. The malware also drops debug logs under the temp folder.

Malicious Ransomware Encryptor Execution with Password Gate (via process_creation)

This rule detects a binary launched with password and no-admin arguments characteristic of the Qilin ransomware encryptor. Operators executed the encryptor with a long password and a no-admin flag to skip UAC prompts during mass encryption.

Malicious DNS Query To FvncBot Android Banking Trojan C2

This rule detects DNS resolution of naleymilva.it.com, the command-and-control domain of the FvncBot Android banking trojan targeting Poland. Infected devices resolve this domain to register and receive operator commands over HTTP and WebSocket. Alerting on the hardcoded C2 domain identifies devices beaconing to the trojan infrastructure.

Suspicious AppLaunch Process Hollowing Target

This rule detects execution of the .NET AppLaunch.exe host outside of legitimate Visual Studio contexts. This behavior matches HeartCrypt which performs process hollowing into AppLaunch.exe and csc.exe to run decrypted payloads under a trusted binary. AppLaunch.exe spawned by unexpected parents is a hollowing indicator used to disguise malicious code as a signed Microsoft process.

Suspicious OAuth Application Registration with Localhost Reply URL via Azure AD

This rule detects registration or update of an Azure AD OAuth application whose reply or redirect URL points to an anomalous localhost loopback endpoint such as http://localhost:7823/access/. This behavior was observed in OAuth application attacks researched by Huntress where adversaries register illicit applications to harvest tokens. Attackers abuse consented OAuth apps to maintain persistent access to cloud mailboxes and data, so anomalous reply URLs are a strong early indicator of illicit app registration.