Sigma detection rules, expert-reviewed

Malicious Host Set with Unconstrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Host Set with Constrained Delegation (via security)

This rule detects modifies host delegation settings for privilege escalation.

Masquerading Computer Account Manipulation for Delegation - RBCD (via security)

This rule detects manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

This rule detects bitsadmin.exe configuring a background transfer job to launch a command when it completes, using SetNotifyCmdLine or a long-lived custom job, an abuse of the Background Intelligent Transfer Service for stealthy persistence and execution. BITS abuse appears in the Red Canary Threat Detection Report as a way to survive reboots and run payloads under a trusted service. Detecting notify-command job setup surfaces the persistence mechanism.

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

This rule detects whoami being run with its output redirected into a file, a reconnaissance-and-staging behavior used by loaders such as SocGholish to capture the current user and privilege context for the operator to review. Automated whoami-to-file collection is documented in the Red Canary Threat Detection Report as an early post-compromise step. Because interactive users rarely redirect whoami output to disk, this is a useful indicator of scripted hands-on activity.

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

In-Memory AMSI or ETW Bypass in PowerShell (via process_creation)

This rule detects PowerShell command lines containing AMSI or ETW bypass constructs (AmsiScanBuffer, amsiInitFailed, System.Management.Automation.AmsiUtils or EtwEventWrite patching), which blind script scanning and telemetry so malicious code runs undetected. AMSI and ETW tampering is a defense-evasion technique highlighted in the Red Canary Threat Detection Report. Detecting these strings surfaces an attacker disabling instrumentation before executing a payload.

Suspicious Command Execution Inside a Kubernetes Pod (via audit)

This rule detects a create request against the pods/exec subresource, which opens an interactive shell inside a running container, a technique attackers use for hands-on-keyboard access to a Kubernetes workload. Exec into pod is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these requests surfaces interactive access to container workloads.

Malicious Service Permissions Hijacked for Privileges Abuse - Service (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

This rule detects a program launching from a mounted ISO, IMG or VHD volume, the delivery pattern adversaries use to bypass Mark-of-the-Web so downloaded payloads run without SmartScreen or Office protections. Container-file delivery is a recurring initial-access and defense-evasion behavior in the Red Canary Threat Detection Report, favored by loaders arriving through phishing. Detecting execution from a freshly mounted image surfaces the smuggled payload before it detonates.

Malicious Service Abuse with Backdoored "command Failure" - Service (via process_creation)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

CMSTP Execution of an INF Profile (via process_creation)

This rule detects cmstp.exe processing an INF connection profile, including remote profiles, a signed-binary proxy technique used to run commands and bypass application allowlisting and UAC. CMSTP abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-installer abuse for code execution.

Malicious Account Set with Reversible Encryption - Weakness Introduction (via security)

This rule detects set an account with reversible encryption to facilitate brutforce or cracking operations.

Suspicious Disabled Guest or Builtin Account Activated (via security)

This rule detects enables a disabled builtin account.

PsExec Remote Service Execution on Target Host (via process_creation)

This rule detects the PSEXESVC service binary executing on a host, which indicates a remote PsExec-style command was pushed to this machine over SMB for lateral movement. PsExec remote execution is a lateral-movement technique frequently seen in the Red Canary Threat Detection Report. Detecting the service-side artifact surfaces remote command execution landing on the target.