Sigma detection rules, expert-reviewed

Suspicious Number of Oustanding SMB Requests Increased (via process_creation)

This rule detects (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

This rule detects execution of network scanners such as nmap, masscan or zmap, a network-service-discovery technique attackers run to map reachable hosts and open ports for lateral movement. Internal scanning is tracked in the Red Canary Threat Detection Report. Detecting scanner execution surfaces reconnaissance from a compromised host.

Malicious LSASS Dump via Process Access (via process_access)

This rule detects attempt to dump LSASS process with tools like Mimikatz.

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

This rule detects commands that flush iptables rules or stop the ufw/firewalld service, a defense-impairment step attackers take to remove filtering that would block command-and-control or lateral movement on a Linux host. Disabling the host firewall is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting these commands surfaces host defenses being lowered.

Malicious Remote Script Piped Directly to a Shell (via process_creation)

This rule detects curl or wget output piped straight into sh or bash on Linux, a one-line download-and-execute pattern used to fetch and immediately run a remote payload. Piping a downloaded script to a shell is an ingress-and-execution technique tracked in the Red Canary Threat Detection Report. Detecting this chain surfaces remote code execution as it happens.

Suspicious SMB Insecure Guest Authentication Activated - Native (via security)

This rule detects enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.

Malicious Cryptocurrency Miner Execution (via process_creation)

This rule detects command lines carrying cryptomining indicators such as stratum pool URLs, --donate-level or known miner names, a resource-hijacking impact technique that runs coin miners on compromised Linux hosts. Cryptomining is tracked in the Red Canary Threat Detection Report. Detecting these arguments surfaces unauthorized use of compute resources.

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

This rule detects rundll32.exe executing a named or ordinal export from a DLL located in AppData, ProgramData or Temp, the execution behavior IcedID and Bumblebee use to run a downloaded loader. Rundll32 export execution from user-writable paths is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loaders running under a signed binary.

Possible Clipboard Data Capture via PowerShell (via process_creation)

This rule detects PowerShell reading the clipboard through Get-Clipboard or the Forms Clipboard class, a collection technique used to steal copied passwords, tokens or wallet addresses. Clipboard capture is tracked in the Red Canary Threat Detection Report. Detecting these calls surfaces harvesting of sensitive copied data.

Renamed User Account Creation Disguised in a Computer Account (via security)

This rule detects creates a user account that fakes a computer account.

Suspicious Raspberry Robin Msiexec Spawning a Proxy Binary (via process_creation)

This rule detects msiexec.exe spawning rundll32, odbcconf or regsvr32, the post-install execution chain Raspberry Robin uses to hand off to a signed-binary proxy after a remote MSI install. This msiexec-to-LOLBIN chain is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting the parent-child pair surfaces loader activity following an MSI download.

Malicious Modification of a User Account SPN to Enable Kerberoast Attack (via security)

This rule detects update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.

Suspicious Secure Deletion of Free Space via Cipher (via process_creation)

This rule detects cipher.exe run with the /w wipe switch, which overwrites free disk space and is abused to destroy recoverable data or securely erase attacker artifacts. Data destruction via cipher is an impact and anti-forensic technique tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces deliberate data wiping.

Malicious Account Set with Kerberos DES Encryption Activated - Weakness Introduction (via security)

This rule detects set an account with DES Kerberos encryption to perform ticket brutforce.

Suspicious Browser Extension Sideload From a User Path (via process_creation)

This rule detects a Chromium-based browser launched with --load-extension pointing at an extension in AppData, Temp or ProgramData, the persistence behavior ChromeLoader uses to inject a malicious browser extension. Loading an unpacked extension from a user-writable path is a technique tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces browser hijacking for adware or credential theft.