Sigma detection rules, expert-reviewed

Malicious NTDS Database Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating a full copy of the Active Directory database, the credential theft step Volt Typhoon performs to obtain the domain NTDS.dit file and all account hashes. Dumping the directory database enables offline cracking and domain wide impersonation, so this operation on a domain controller is a high confidence indicator of hands on keyboard credential access.

Possible FortiGate RCE via Chunked hostcheck_validate Request (CVE-2024-21762)

This rule detects POST requests to the FortiGate SSL VPN hostcheck_validate endpoint using Transfer-Encoding chunked, matching the out-of-bounds write exploited in CVE-2024-21762 as analyzed by Assetnote. The exploit relies on a malformed chunked body with a zero-length terminator and excess trailer lines to corrupt memory and reach code execution. Detecting chunked requests to this specific endpoint surfaces attempts against the vulnerable parser.

Malicious AMSI Bypass via PowerShell amsiInitFailed Patch

This rule detects PowerShell reflection that flips the AMSI amsiInitFailed field to disable in-memory script scanning. Fake browser update chains delivering BitRAT and Lumma Stealer used this to blind AMSI before reflective .NET loading. Disabling AMSI removes a primary defense against staged malicious payloads.

Suspicious Windows Service Executing Batch File from Temp Directory

This rule detects Windows service creation whose ImagePath runs cmd.exe against a batch file staged in a temp directory, observed by Huntress where a masquerading service named WebrootCheck launched a batch file from c colon temp. Attackers register a legitimate-looking service to execute attacker scripts with SYSTEM privileges and persist. A service that runs a temp-directory batch file combines a benign-looking name with a suspicious execution context and is a strong persistence indicator.

Suspicious Level.io RMM Silent Install via PowerShell (via ps_script)

This rule detects a PowerShell one-liner pulling the Level.io RMM installer from downloads.level.io, abused as unauthorized remote access tooling during a ransomware precursor intrusion. Threat actors deploy Level.io alongside Cobalt Strike on a unified command-and-control channel to retain persistent control. Unexpected RMM installation is a strong sign of adversary tradecraft.

Malicious PRT Token Forging via AADInternals (via ps_script)

This rule detects AADInternals cmdlets that mint or export Primary Refresh Token material and device certificates for cloud identity abuse. The cloud lateral-movement research shows attackers use these to forge tokens and access cloud resources as the victim. The cmdlet names are specific to this toolkit and indicate token theft or forgery.

Malicious Hidden PowerShell Execution From PerfLogs via Process Creation

This rule detects PowerShell launched with a hidden window that references an executable under the PerfLogs directory. The DroxiDat and SystemBC intrusion staged payloads such as hos.exe in C:\perflogs and executed them through hidden PowerShell, a technique used to run malware from an unusual location while suppressing any visible window.

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

This rule detects mstsc.exe writing _TS prefixed temporary files, the bitmap cache artifacts produced when a victim connects to a rogue RDP server delivering redirected remote applications. Presence of these client cache files corroborates outbound rogue RDP sessions used for data access.

Malicious Security Service Deletion via Sc

This rule detects sc.exe deleting Microsoft Defender and EDR related services such as Sense, WdFilter, or SgrmAgent, permanently removing protection components. This tampering is a hallmark of ransomware playbooks that disable endpoint defenses before impact. Deleting these services blinds detection and prevents recovery of protection without reinstallation.

Suspicious Scheduled Task Named ServiceHub.TestWindowStoreHost by Mustang Panda

This rule detects creation of a scheduled task named ServiceHub.TestWindowStoreHost, a persistence artifact associated with the TONESHELL variant used by Mustang Panda. The task name masquerades as a legitimate Visual Studio service component.

Possible VMware Workspace ONE SSRF via instanceHealth hostName At-Injection (via webserver)

This rule detects requests to the SAAS REST instanceHealth endpoint whose hostName or path parameters contain an at-sign injection redirecting the server-side request to an attacker host. This is the post-auth SSRF CVE-2021-22056 used to leak administrative JWT Authorization tokens from internal cluster instances. Detecting it surfaces token theft and internal request forgery against the vulnerable appliance.

Suspicious Azure Credential Hunting via MicroBurst Modules

This rule detects execution of MicroBurst secret-hunting PowerShell modules used to enumerate and extract credentials from Azure resources such as automation accounts, logic applications, and VM extensions. Such activity indicates cloud credential harvesting during an intrusion.

Malicious VOLTZITE NTDS.dit Credential Staging in Temp Directory (via process_creation)

This rule detects command lines that reference the Active Directory database file ntds.dit together with copy or staging operations into temporary and world-writable directories. VOLTZITE stages ntds.dit in local and temp folders to extract domain credentials from compromised infrastructure. Access to the domain database enables offline password hash extraction and broad lateral movement.

Malicious Ransomware Self-Deletion via Ping Loopback and Del

This rule detects a command line that pings the unusual loopback address 127.0.0.7 and then deletes a file, a self-removal and timing-delay technique used by Mamona ransomware after encryption. The non-standard loopback octet combined with a delete command is a strong anti-forensic indicator.

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

This rule detects exiftool spawning setfile or a shell interpreter as a child process, the command injection sink exploited in CVE-2026-3102 when a crafted image reaches the SetMacOSTags system call. The injected command runs attacker controlled code on macOS during metadata processing. Detecting exiftool as the parent of these processes surfaces exploitation of the vulnerability.