Sigma detection rules, expert-reviewed

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via Command (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

XSL Script Processing via WMIC or MSXSL (via process_creation)

This rule detects XSL script processing through wmic.exe /format with a remote or local .xsl stylesheet or through msxsl.exe, both of which execute embedded script and proxy code past application allowlisting. XSL script processing is a signed-binary-proxy-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary abuse used to run attacker-controlled script.

Obfuscated File Decoding via Certutil (via process_creation)

This rule detects certutil being used with its decode flags to convert a base64 or hex-encoded file back into an executable payload, a deobfuscation step adversaries use to reconstruct malware from a benign-looking encoded file. Certutil deobfuscation is a defense-evasion technique in the Red Canary Threat Detection Report because it hides payloads from content inspection in transit. Detecting decode invocations surfaces payload staging under a trusted binary.

Malicious Network Share Manipulation via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Uncommon File Download via Uncommon LOLBIN (via process_creation)

This rule detects file-download abuse of lesser-known living-off-the-land binaries such as certreq -Post, desktopimgdownldr lockscreenurl and finger, which retrieve remote content while blending into signed Windows tooling. Ingress tool transfer via LOLBINs is a technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces payload retrieval that evades naive download monitoring.

Malicious Microsoft Defender Critical Security Components Disabled - Command (via process_creation)

This rule detects disable Defender security features.

Malicious User Password Change Without Previous Password Known - SetNTLM - Mimikatz (via security)

This rule detects perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

This rule detects wmic.exe invoking process call create, frequently against a remote node, which spawns a process through WMI for lateral movement or remote execution. WMIC-based remote execution is a technique tracked in the Red Canary Threat Detection Report for its use in hands-on-keyboard intrusions. Detecting this invocation surfaces attacker movement that blends into legitimate management traffic.

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

This rule detects aspnet_compiler.exe being executed to compile and run arbitrary code, a signed-binary proxy technique used by AsyncRAT and similar tooling to build a payload in place while evading application allowlisting. Aspnet_compiler abuse is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting this rarely-interactive binary surfaces trusted-utility code execution.

Malicious Mimikatz Driver Registration - Reg via Sysmon (via registry_event)

This rule detects installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

Suspicious systemd Service Persistence Creation (via process_creation)

This rule detects creation or enabling of a systemd unit under the system service directories, a persistence technique that runs an attacker binary at boot with elevated privileges on Linux. Systemd service persistence is tracked in the Red Canary Threat Detection Report. Detecting the unit write and enable surfaces a boot-persistent foothold.

Malicious Microsoft Defender Service Deactivation Attempt - Command (via process_creation)

This rule detects disable Defender security service. If tamper protection is enabled, this action may not work.

Suspicious Number of Oustanding SMB Requests Increased (via process_creation)

This rule detects (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

This rule detects execution of network scanners such as nmap, masscan or zmap, a network-service-discovery technique attackers run to map reachable hosts and open ports for lateral movement. Internal scanning is tracked in the Red Canary Threat Detection Report. Detecting scanner execution surfaces reconnaissance from a compromised host.

Malicious LSASS Dump via Process Access (via process_access)

This rule detects attempt to dump LSASS process with tools like Mimikatz.