Sigma detection rules, expert-reviewed

Suspicious Khmer Shadow C2 Beacon with Malformed Chrome User-Agent (via proxy)

This rule detects outbound requests carrying the malformed Chrome 131 on Windows 10 user-agent string used by the Khmer Shadow implant to blend its C2 traffic. Adversaries craft this non-standard agent value that does not match any real browser build. The exact malformed string provides a low-noise channel indicator for this espionage cluster.

Malicious Credential Exfiltration to webhook.site

This rule detects curl posting data to a webhook.site endpoint, the exfiltration channel used by the Shai-Hulud worm to send harvested secrets to attacker-controlled webhooks. The worm labels these requests to correlate stolen data from each compromised host.

Suspicious Office Application Spawning Script Interpreter (via process_creation)

This rule detects Excel or Word spawning a scripting interpreter such as wscript or powershell which the DarkGate remote template injection chain triggers to move from a malicious document to a VBS and PowerShell stager. Office applications launching script hosts is a hallmark of macro and template based initial access.

Suspicious macOS Quarantine Attribute Removal via xattr (via process_creation)

This rule detects xattr removing the com.apple.quarantine attribute from a file. Stripping this attribute clears the download provenance that triggers Gatekeeper checks allowing a downloaded payload to launch without warning. Attackers use this to make internet-sourced binaries appear locally trusted.

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

This rule detects winword.exe spawning mshta.exe, splwow64.exe, powershell.exe or cmd.exe, the exploitation chain of CVE-2023-36884 by Storm-0978. A weaponized document triggers these anomalous child processes to fetch and run a RomCom-like backdoor after the victim opens the lure.

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

This rule detects cmd.exe reading and executing content from an NTFS alternate data stream attached to a decoy PDF using input redirection. TA397 delivered LNK files that ran a hidden PowerShell stage stored in a PDF ADS such as ~tmp.pdf.

Windows: Detect LSASS crashes caused by netlogon.dll stack buffer overrun (STATUS_STACK_BUFFER_OVERRUN)

Alerts on lsass.exe crashes blamed on netlogon.dll with STATUS_STACK_BUFFER_OVERRUN (0xc0000409) in Windows Application Error (EventID 1000).

Suspicious Executable Launched from Public Music Folder

This rule detects process execution from the C:\Users\Public\Music directory, a staging path used by RansomHub affiliates to run randomly named ransomware encryptor binaries. Legitimate applications rarely execute from the public Music folder, so execution there is a strong indicator of staged malware.

Malicious ESXi Virtual Machine Termination via esxcli (via process_creation)

This rule detects enumeration and forced termination of running virtual machines through esxcli vm process list and esxcli vm process kill commands. The Linux variant of Helldown ransomware uses this technique to stop VMs before encrypting their datastore files on ESXi hosts. Killing virtual machine worlds ensures files are unlocked so the ransomware can encrypt them and disrupt the entire virtualized environment.

Suspicious Azure OpenAI Training File Upload via Files Import Operation (via azure)

This rule detects the Azure OpenAI Files_Import and Files_Upload operations in diagnostic logs, the behavior Red Canary linked to model poisoning and data staging where an actor uploads fine-tuning files to an OpenAI resource. Unexpected file uploads to an Azure OpenAI deployment can indicate poisoning of training data or staging for later exfiltration.

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

This rule detects creation of a shell script under /etc/profile.d/ that executes for every interactive login shell. During Ivanti post-exploitation lateral movement the actor planted a cron.sh style script in profile.d to re-establish access on login. New executable scripts in profile.d are a well-known Linux persistence mechanism warranting review.

Suspicious Shell Execution Into Kubernetes Pod via API

This rule detects Kubernetes API exec subresource requests whose request URI invokes an interactive shell such as bin bash or bin sh inside a running pod as described in NCC Group Kubernetes detection engineering research. Adversaries abuse pod exec to gain interactive access to containers for reconnaissance and lateral movement so unexpected shell sessions should be reviewed.

Malicious Rogue Root User Creation via Useradd UID Zero

This rule detects useradd invoked with the non-unique flag and a UID of 0 which creates a hidden secondary root-equivalent account for persistence and privilege escalation on Linux. Adversaries add a UID 0 account to retain full administrative control while blending in as an ordinary user.

Malicious TeamPCP LiteLLM Credential Exfiltration C2 Lookup (via dns_query)

This rule detects DNS lookups for the checkmarx.zone and models.litellm.cloud command-and-control hosts used by the trojanized LiteLLM PyPI packages to exfiltrate harvested environment variables and cloud credentials. A resolution of either host on a build or developer machine indicates the malicious LiteLLM payload has executed and is calling home.

EtherRAT Node.js Backdoor Execution via Headless Conhost (via process_creation)

This rule detects the EtherRAT backdoor launched through conhost.exe in headless mode running a bundled Node.js payload from the hidden MicrosoftSltt directory, an execution behavior observed in The Gentlemen ransomware intrusions using Ethereum smart-contract C2. Adversaries leverage the signed conhost host to run a Node.js runtime and blend malicious JavaScript execution into normal process activity.