Sigma detection rules, expert-reviewed

Suspicious HTA Execution via Mshta From Shortcut Chain (via process_creation)

This rule detects mshta.exe launching an HTA file which the CoralRaider infection triggers from a malicious LNK to start its multi-stage information stealer chain. Using the trusted mshta LOLBin to run remote or local HTA content is a signed proxy execution technique that evades application controls.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Suspicious Msiexec Execution with Undocumented -z Flag Proxying DLL (via process_creation)

This rule detects msiexec invoked with the undocumented -z switch, which forces execution of the DllUnregisterServer export of a bundled library. Matanbuchus and DarkGate loaders abused this to proxy malicious DLL execution through a trusted signed binary.

In-Memory VShell Downloader Piping curl and wget Fallback Into Shell (via process_creation)

This rule detects a single command line that combines curl and a wget fallback and pipes the retrieved payload directly into a shell, the download-and-execute pattern used by VShell to fetch its second stage from the C2 server. Adversaries leverage the dual-tool fallback to survive missing utilities and run code without touching disk, making detection of this construct useful for catching in-memory staging on Linux.

Suspicious Phantom Msfte.dll Load by Search Indexer (via image_load)

This rule detects the Windows Search Indexer loading msfte.dll, a phantom DLL that does not ship with modern Windows and that attackers plant to hijack the indexer search path for stealthy persistence. Because the legitimate file is absent on current systems, a successful load of msfte.dll by SearchIndexer.exe points to a planted malicious library.

Malicious UAC Bypass via SilentCleanup Scheduled Task Trigger

This rule detects schtasks running the built-in SilentCleanup task, the trigger stage of the environment-variable UAC bypass used by NightshadeC2. After hijacking the windir variable the botnet forced SilentCleanup to run so its auto-elevated context executed the attacker payload. On-demand invocation of SilentCleanup via schtasks is a reliable indicator of this UAC bypass.

Suspicious Rclone Remote-Control Daemon For Data Exfiltration

This rule detects rclone launched with the rcd remote-control daemon argument. The MedusaLocker operator used rclone rcd to exfiltrate victim data to cloud storage before deploying ransomware. Rclone running as a remote-control daemon on an endpoint is a strong sign of automated bulk exfiltration to a cloud service.

Malicious Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell, indicative of xp_cmdshell abuse. Estate Ransomware operators enabled xp_cmdshell on a Veeam-linked MSSQL instance to run operating system commands. Command execution from the database engine signals exploitation of the SQL layer.

Suspicious msiexec Installation From Non-Standard Path

This rule detects msiexec.exe installing an MSI package from a user writable or remote location such as AppData, Temp, ProgramData or an HTTP URL, an execution-proxy technique used by the Handala group to run malicious installers from untrusted paths. Legitimate installers usually run from trusted staging or download folders rather than these locations. Combined with other indicators this points to attacker-driven payload deployment.

Suspicious Azure VM Extension Write for Credential Reset via Activity Log

This rule detects Azure Compute virtual machine extension write operations, the activity abused by the VMAccess password reset technique where an attacker supplies an arbitrary caller-controlled extension name to evade name-based detections. Adversaries use this to reset local credentials and gain persistent access to a VM. Unexpected extension writes on sensitive machines should be reviewed as account manipulation.

Suspicious AS-REP Roasting LDAP Search Filter for DONT_REQ_PREAUTH Accounts

This rule detects Directory Service search event 1644 carrying an LDAP filter that uses the bitwise OID to select accounts with the DONT_REQUIRE_PREAUTH flag set, matching Impacket GetNPUsers enumeration for AS-REP roasting. Adversaries query these accounts to request roastable tickets crackable offline. This precise bitwise filter is rarely produced by legitimate directory tooling.

Suspicious macOS Keychain Credential Dump via security Utility (via process_creation)

This rule detects the macOS security command being used to dump keychain contents with the dump-keychain switch and the decrypt flag. Attackers abuse this built-in utility to extract stored passwords and secrets from the user keychain. Requesting a decrypted dump of all keychain items is a hallmark of credential theft on macOS.

Malicious NOOPDOOR Registry Persistence under Software License Key (via registry_set)

This rule detects creation of registry values under Software\License with a hex-named subkey, the storage location used by the NOOPDOOR backdoor deployed by MirrorFace against Japanese organizations. The implant hides encoded configuration and payload data in this uncommon path to survive reboots and blend with legitimate keys.

Suspicious node.exe or code.exe Execution from Public Music Directory

This rule detects node.exe or code.exe running from the C:\Users\Public\Music directory, where ChaosBot staged a FRP tunneling client and a downloaded VS Code binary. Legitimate Node.js and VS Code do not execute from a Public media folder, so this path indicates staged tooling for tunneling and command execution. The wrong-path execution of dual-use binaries reveals attacker infrastructure on the host.

Malicious Command Shell Spawned by Wing FTP Server Process

This rule detects the Wing FTP server process WFTPServer.exe spawning cmd.exe or powershell.exe, the remote code execution chain Huntress observed during in-the-wild exploitation of CVE-2025-47812. Attackers abuse a null-byte and Lua injection flaw to run arbitrary commands as the FTP service. A command shell parented by the FTP server is rarely legitimate and is a high-confidence exploitation indicator.