Sigma detection rules, expert-reviewed

PipeShell Exfiltration Over Named Pipes (via powershell)

This rule detects establishes "PipeShell" connection(s) between a server and client(s) in order to move laterally or exfiltrate data. The server side will trigger "ServerStream" IOCs meanwhile the client side will trigger "ClientStream" IOCs. The rule works based on this condition, where at least 2 hosts need to trigger one of the condition.

Suspicious Certutil URL Download to Public Directory (Soco404 Cryptomining)

This rule detects certutil used with its urlcache flag to fetch a remote payload, the download technique of the Soco404 campaign that staged binaries under the Public user directory. It matters because certutil acting as a downloader is a living off the land pattern used to pull cryptomining payloads onto Windows hosts.

Suspicious NTDS Database Extraction from System Volume

This rule detects command-line references to the NTDS.dit Active Directory database being copied or dumped, a credential-theft step seen in CitrixBleed post-exploitation. Attackers extract NTDS.dit to harvest domain credential hashes for offline cracking and further compromise. Because access to this file outside of backup or DC maintenance is rare, it is a strong indicator of domain credential theft.

CMSTP UAC Bypass via Automatic Install Flag (via process_creation)

This rule detects cmstp.exe invoked with the /au automatic-install flag, the User Account Control bypass used by the Caminho loader in the PureRAT chain to run an INF-defined command with elevated privileges. Adversaries leverage CMSTP as a trusted binary to silently elevate and execute payloads, making detection of this rarely legitimate flag critical for catching privilege escalation before process hollowing.

Suspicious Scheduled Task Masquerading as EdgeUpdateHelper via process_creation

This rule detects schtasks.exe creating a scheduled task named EdgeUpdateHelper. GhostSocks operators use this Edge-updater-themed task name to blend malicious persistence with legitimate Microsoft Edge update tasks, keeping the infostealer running while evading casual review of scheduled tasks.

Malicious C2 Configuration Stored in Registry via TitanPlus Key (via registry_set)

This rule detects the creation of the TitanPlus registry key used by the STAC5777 threat cluster to store a list of command and control IP addresses and ports read by a sideloaded malicious DLL. The activity followed Microsoft Teams vishing and Quick Assist abuse and provides resilient C2 configuration storage.

Malicious Member Added to DNSadmin Group (via security)

This rule detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.

Suspicious Deletion of a Scheduled Task to Cover Tracks (via process_creation)

This rule detects schtasks being used to force-delete a scheduled task, a cleanup step attackers take to remove an execution or persistence artifact after it has served its purpose. Scheduled-task deletion is an indicator-removal technique noted in the Red Canary Threat Detection Report. Detecting the deletion surfaces anti-forensic activity around task-based execution.

Suspicious Chained Host Reconnaissance One-Liner via DenoGate Backdoor

This rule detects a single cmd.exe command chaining ipconfig, route print, and tasklist to profile the network and running processes. The DenoGate backdoor runs this reconnaissance one-liner shortly after gaining access to map the victim environment. Bundling several enumeration commands into one line is uncommon for administrators and signals automated triage by an implant.

Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain

This rule detects DNS resolution of the rnsnno phishing infrastructure hosted under the .pro top-level domain that was used in an HTML smuggling adversary-in-the-middle campaign. Victims delivering credentials to these domains had their Microsoft 365 sessions relayed and stolen. Resolution of this infrastructure indicates a user has interacted with the phishing lure.

Possible Yellowfin BI JWT Forgery via refresh-tokens Endpoint

This rule detects HTTP requests to the Yellowfin BI /api/refresh-tokens endpoint associated with forged JWT abuse. Assetnote used hardcoded signing keys to mint tokens against this API before triggering JNDI-injection remote code execution, so anomalous access here can indicate exploitation.

Suspicious Run Key Persistence Masquerading as Edge Updater

This rule detects a Run key named EdgeUpdater whose value points into the user AppData directory. The Blitz malware creates this entry to masquerade as a legitimate Microsoft Edge updater while referencing a payload in a user-writable location. The mismatch between a trusted name and an untrusted path indicates masquerading persistence.

Malicious Storm-0558 Forged Token Sign-In from MSA Consumer Tenant (via azure signinlogs)

This rule detects Entra ID sign-ins whose home tenant is the Microsoft consumer MSA tenant 9188040d-6c67-4c5b-b112-36a304b66dad, the issuer Storm-0558 impersonated with a stolen MSA signing key to forge OpenID v2.0 tokens against Exchange Online and other organizational resources. Tokens minted for enterprise access from this consumer issuer indicate forged-credential authentication and should be treated as identity compromise.

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious COM Object Hijack Pointing to IconCache DLL

This rule detects a COM object InProcServer32 registration whose default value references an iconcache prefixed DLL in the Explorer directory. Operation ForumTroll established persistence via a COM hijack under HKCR CLSID InProcServer32 pointing at its payload DLL as documented by Kaspersky. This combination of a COM handler mapped to a masquerading DLL path indicates stealthy persistence and defense evasion.