Sigma detection rules, expert-reviewed

Malicious BYOVD ThrottleStop Vulnerable Driver Load (via image_load)

This rule detects loading of the ThrottleStop vulnerable driver including the renamed ThrottleBlood.sys variant used in a Bring Your Own Vulnerable Driver attack to terminate security products. The driver exposes a device that lets an unprivileged process kill protected antivirus and EDR processes such as MsMpEng and SentinelAgent. Loading this kernel driver on a server or workstation with no ThrottleStop application present is highly suspicious.

Suspicious Rclone Configuration File Creation in User Config Directory

This rule detects creation of an Rclone configuration file under a user config directory which stores the cloud remote definitions used for exfiltration. NCC Group observed rclone.conf written under the user profile before data transfer to MEGA. Presence of this artifact indicates staging of an exfiltration channel.

Suspicious Bash Reverse Shell via /dev/tcp

This rule detects Bash command lines that redirect a shell to a /dev/tcp socket, a fileless reverse-shell technique. This was used against Linux and SAP hosts following CVE-2025-31324 exploitation to obtain interactive remote access. Legitimate administrative use of /dev/tcp is uncommon and warrants investigation.

Malicious Auto-Color Backdoor Self-Copy on Linux (via process_creation)

This rule detects references to the /var/log/cross/auto-color path where the Auto-Color Linux backdoor copies itself for persistence while masquerading inside a log directory. Placing an executable under /var/log is an evasive persistence technique meant to avoid scrutiny of typical binary locations.

Suspicious Domain Computers Group Enumeration via Net Command (via process_creation)

This rule detects enumeration of the domain computers group using the net command, a discovery step observed during SolarWinds Web Help Desk post-exploitation. Observed in Elastic Security Labs telemetry where net group domain computers /domain maps Active Directory assets to plan lateral movement.

SharpHound Enumeration via SMB Named Pipes (via security)

This rule detects enumerate different host via named pipes with SharpHound for discovery purposes.

Suspicious Microsoft Teams Installer Masquerade via MC Teams Binary (via process_creation)

This rule detects execution of a binary named MC Teams.exe, the signed malware sample Red Canary documented masquerading as a Microsoft Teams installer while carrying a Neural Code Technologies Inc. signer. The legitimate Teams installer does not use this filename, so its execution suggests a freshly signed masquerading binary abusing code-signing trust.

Malicious RDP Session Hijack via Service Creation Abuse (via security)

This rule detects create a service that triggers TSCON in order to preform local RDP session hijack.

NTFS Symbolic Link Configuration Change (via process_creation)

This rule detects modify the type of symbolic link than can be created.

Suspicious AutoIt Script Execution of AU3 Payload (via process_creation)

This rule detects an AutoIt interpreter executing an AU3 script, the execution stage DarkGate uses to decrypt and inject its payload. DarkGate operators abuse legitimate AutoIt binaries, often renamed, to run encrypted AU3 scripts. Legitimate AU3 execution exists, so pairing with staging context reduces noise.

Suspicious PowerShell Get-Content Piped to PowerShell (via process_creation)

This rule detects PowerShell reading a file with Get-Content and piping the result through Out-String into another PowerShell instance. The STEADY#URSA campaign used this pattern to execute the covert SUBTLE-PAWS backdoor stager.

Malicious Netcat Reverse Shell with Command Execution Flag (via process_creation)

This rule detects netcat launched with the -e flag to pipe a shell to a remote endpoint. Actors exploiting F5 BIG-IP and ScreenConnect used nc -e /bin/bash to obtain interactive reverse shells on compromised hosts. The -e execution flag combined with a shell path is a well-established reverse-shell indicator.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware

This rule detects the LocalAccountTokenFilterPolicy registry value being set to one, which disables remote UAC filtering and grants full administrative access for local accounts over the network. BlackByte ransomware sets this value to ease lateral movement.

Malicious NTDS Database Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating a full copy of the Active Directory database, the credential theft step Volt Typhoon performs to obtain the domain NTDS.dit file and all account hashes. Dumping the directory database enables offline cracking and domain wide impersonation, so this operation on a domain controller is a high confidence indicator of hands on keyboard credential access.

Possible FortiGate RCE via Chunked hostcheck_validate Request (CVE-2024-21762)

This rule detects POST requests to the FortiGate SSL VPN hostcheck_validate endpoint using Transfer-Encoding chunked, matching the out-of-bounds write exploited in CVE-2024-21762 as analyzed by Assetnote. The exploit relies on a malformed chunked body with a zero-length terminator and excess trailer lines to corrupt memory and reach code execution. Detecting chunked requests to this specific endpoint surfaces attempts against the vulnerable parser.