Sigma detection rules, expert-reviewed

Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)

This rule detects the hardcoded FRP authentication token frpforzhangwei used by CL-UNK-1068 to establish fast reverse proxy tunnels into victim networks. This unique token constant identifies the actor's tunneling infrastructure, providing persistent encrypted access for command and control and lateral movement.

Suspicious Extraction of PuTTY SSH Host Keys via Reg Export (via process_creation)

This rule detects export of the PuTTY SshHostKeys registry key, used by CL-UNK-1068 to harvest cached SSH host key material for lateral movement to Unix and network infrastructure. Recorded SSH host keys reveal previously accessed remote systems, so this extraction supports pivoting deeper into the environment.

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an Install From Media snapshot of the Active Directory database, a credential access technique used by actors following BeyondTrust CVE-2026-1731 exploitation. The IFM snapshot exports the NTDS.dit hive containing domain password hashes, enabling full domain compromise, so this activity should be treated as active credential theft.

Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)

This rule detects the BeyondTrust Bomgar remote support agent spawning a command shell, a behavior observed during exploitation of critical vulnerability CVE-2026-1731 by actors deploying VShell and SparkRAT. The remote support binary should not launch cmd.exe or powershell.exe, so this chain indicates remote code execution against the appliance and warrants immediate response.

Malicious ESXi Firewall Disable via esxcli (via process_creation)

This rule detects the esxcli command that disables the ESXi host firewall, a defense-evasion action performed by the RansomHouse MrAgent tool before mass VM encryption. Turning off the hypervisor firewall opens management and lateral-movement paths ahead of the Mario ransomware deployment.

Malicious Reverse Shell via bash dev tcp Redirection (via process_creation)

This rule detects an interactive bash reverse shell that redirects a session over the /dev/tcp pseudo-device, delivered after exploitation of the React Server Components vulnerabilities. The one-liner opens a network socket back to the attacker for hands-on-keyboard control of the compromised server.

Malicious Command Injection Probe via node Spawning Shell Arithmetic Echo (via process_creation)

This rule detects a node process spawning /bin/sh to echo an arithmetic expression, the validation probe used when exploiting the React Server Components vulnerabilities CVE-2025-55182 and CVE-2025-66478. Attackers confirm remote command execution by evaluating a math expression through the injected shell before delivering payloads.

Malicious Scheduled Task Masquerading as Windows Defender Updater (via process_creation)

This rule detects creation of a scheduled task named to impersonate Windows update or Defender maintenance, a persistence technique used by the Hamas-affiliated Ashen Lepus AshTag malware suite. The benign-looking task names Windows Defender Updater and Automatic Windows Update disguise attacker-controlled recurring execution.

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

This rule detects a self-deletion chain that pings the 127.0.0.7 loopback address as a timing delay before force-deleting a file, a cleanup routine used by the 01flip ransomware to remove its own binary after execution. Chaining ping to loopback with del /f /q lets the malware wait for its parent to exit and then erase traces.

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

This rule detects use of fsutil setZeroData, which overwrites file regions with zeros to prevent forensic recovery, a self-delete and anti-recovery step in the 01flip Rust ransomware Windows chain. The technique destroys the original binary and data remnants after encryption to inhibit recovery and analysis.

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

This rule detects a process launched with the SHA1HULUD marker on its command line, the self-identifying tag used by the Shai-Hulud npm supply-chain worm. The worm spawns processes named SHA1HULUD during propagation and token theft, so this constant is a high-confidence indicator of compromise on developer and CI hosts.

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

This rule detects the WSUS service or its worker process spawning a command interpreter, the immediate post-exploitation behavior of CVE-2025-59287 remote code execution. WSUS components should never launch cmd or PowerShell, so this chain marks active exploitation. Detecting it exposes attacker command execution on a patch-management server used as an entry point.

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

This rule detects MSBuild launched as a child of PowerShell, the final stage of the PhantomVAI loader chain that injects infostealer code into the trusted Microsoft build utility. MSBuild is abused as a signed process host to evade defenses. Detecting this parent-child relationship exposes process injection delivering commodity infostealers.

Suspicious GeoServer Java Process Spawning Download Utility

This rule detects a Java or shell process spawning wget or curl to fetch a payload from a port 8080 host. Attackers exploiting the GeoServer JXPath remote code execution flaw use Runtime.exec to pull stager scripts over HTTP. A web application process downloading from an atypical port indicates exploitation and payload retrieval.

Suspicious Script Host Downloader via MSXML and WScript Shell

This rule detects the Windows script host executing a WSF or JS downloader that then spawns PowerShell. The DarkCloud delivery uses MSXML2.XMLHTTP and WScript.Shell inside a script file to fetch a PowerShell stage from remote infrastructure. Script host to PowerShell chaining is a common malware download and execute pattern.