Sigma detection rules, expert-reviewed

Obfuscated Fickle Stealer Injection Path Store prepares.dat Under Public (via file_event)

This rule detects creation of prepares.dat in the public users directory, the file where Fickle Stealer stores base64-encoded paths of injected components for its multi-stage execution. Adversaries leverage this world-writable location to persist loader state, making detection of the fixed filename and path a useful indicator of an active Fickle infection.

Suspicious Cached Logon Disable via Winlogon CachedLogonsCount (via registry_set)

This rule detects modification of the Winlogon CachedLogonsCount value, which the Lotus Wiper sets to zero to remove cached domain credentials and hinder recovery. Disabling cached logons contributes to the destructive impact of the wiper against energy and utilities targets. Detecting this rare registry change highlights defense weakening prior to disk destruction.

Suspicious Certutil URLCache Download

This rule detects certutil.exe used with the urlcache option to download a remote file. The DragonRank SEO-poisoning operators abused certutil urlcache to pull additional tooling onto compromised IIS servers. Certutil functioning as a downloader is a living-off-the-land ingress technique that evades controls expecting a browser or dedicated transfer tool.

Suspicious Credential File Discovery via Find on Linux

This rule detects use of the find utility to recursively search common home and system directories for environment key and credential files which React2Shell CVE-2025-55182 post-exploitation scripts use to locate AWS SSH and application secrets for theft. Broad filesystem searches targeting env and key extensions indicate automated credential discovery on a compromised host.

Suspicious DarkGate Cleanup Batch Execution

This rule detects execution referencing DarkGate working artifacts under the C temp tskm folder used to store the id.txt bot identifier. DarkGate stages its runtime files and identifier in this fixed location, so command lines touching it indicate the loader is active.

Suspicious SOAPHound Tautological LDAP Filter Enumeration

This rule detects Directory Service event 1644 LDAP queries using the tautological filter (!(FALSE)) which matches every object, a signature of SOAPHound style collection that pulls the full directory in bulk. The always-true filter combined with the SD_FLAGS 0x7 control lets the tool harvest all objects and their security descriptors efficiently. A directory-wide (!(FALSE)) query is a strong indicator of automated Active Directory reconnaissance.

Malicious Impacket-Style Remote Command Execution Pattern (via process_creation)

This rule detects the command shell pattern used by Impacket remote-execution tools such as wmiexec, smbexec and atexec, where cmd.exe runs a command and redirects its output to a local admin share or loopback path (for example 1> \\127.0.0.1\ADMIN$). Remote execution over SMB/WMI is a lateral-movement behavior featured in the Red Canary Threat Detection Report and is heavily used by hands-on-keyboard operators. Detecting this redirect-to-share signature surfaces Impacket-driven lateral movement.

Suspicious Account Disable via net user active no (via process_creation)

This rule detects net.exe disabling a user account with the active no flag, an action the Lotus Wiper performs to remove account access and deny defenders control of affected hosts. Disabling accounts supports the wiper goal of locking users out during a destructive campaign. Detecting this command surfaces account access removal activity.

Suspicious sshd.exe Outbound Connection over SMB Port (via network_connection)

This rule detects the OpenSSH server binary sshd.exe communicating over TCP port 445, an anomalous pairing Stately Taurus used to tunnel SSH sessions across the SMB port to bypass firewall egress restrictions. Running an SSH daemon over the SMB port disguises interactive remote access as normal file-sharing traffic.

Suspicious Network Provider Registration for Credential Interception via NPPSpy

This rule detects the registration of a network provider ProviderPath value under the service control set, the mechanism NPPSpy uses to capture plaintext logon credentials during interactive sign-in as seen in Operation Diplomatic Specter. A rogue network provider silently harvests domain credentials as users authenticate. Detecting this registration exposes credential-access tradecraft on the host.

Malicious S3 Object Encryption with Customer Provided Key via CopyObject

This rule detects S3 CopyObject or PutObject API calls that supply a customer provided SSE-C encryption key which is the technique used in the CopyObjection intrusion to encrypt a victim S3 bucket for ransom. Because the attacker holds the key AWS cannot recover the data making this a destructive extortion action. Detecting SSE-C on bulk object operations surfaces ransomware activity in cloud storage.

Obfuscated Base64-Decoded Payload Piped to Shell via macOS ClickFix Terminal Lure (via process_creation)

This rule detects a terminal one-liner that base64-decodes an embedded payload and pipes it into a shell, the macOS ClickFix execution behavior tricking users into pasting commands into Terminal. Adversaries leverage inline base64 decoding to hide the downloader and run it without writing an obvious script to disk.

Malicious SQL Server Xp_cmdshell Activation - Native Event (via application)

This rule detects enable the xp_cmdshell in order to execute non SQL content and escalate privileges.

Suspicious Download to tmp Followed by chmod Execution on Linux

This rule detects a single command line that downloads a file into a temporary directory and makes it executable. SSH compromise scripts fetch architecture specific botnet binaries into tmp with wget or curl and immediately grant execute permissions before launching them.

Suspicious Script Host Executing VBS from ConnectWiseControl Temp Directory

This rule detects wscript or cscript executing a VBScript dropped under Documents ConnectWiseControl Temp, the staging path used by PhantomControl to run Ande Loader after ScreenConnect delivery. Abusing a remote support tool folder lets attackers stage and run malicious scripts while appearing to be legitimate support automation.