Sigma detection rules, expert-reviewed

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

This rule detects exiftool spawning setfile or a shell interpreter as a child process, the command injection sink exploited in CVE-2026-3102 when a crafted image reaches the SetMacOSTags system call. The injected command runs attacker controlled code on macOS during metadata processing. Detecting exiftool as the parent of these processes surfaces exploitation of the vulnerability.

Obfuscated Lua Loader Execution via Compiler Loading LuaJIT Runtime (via image_load)

This rule detects a generically named Compiler.exe loading the LuaJIT runtime lua51.dll, the execution pattern used by the Lua malware to run an obfuscated Prometheus-protected script through FFI-driven Windows API calls. Adversaries leverage a Lua interpreter shipped alongside a benign compiler binary to execute logic in a scripting layer that resists static analysis, making early detection critical for surfacing the loader before scheduled-task persistence and C2 activity.

Malicious Koi Loader C2 Check-in via Index PHP Beacon (via proxy)

This rule detects Koi Loader command-and-control beacons to an index.php endpoint carrying the campaign-specific subid=px8eIkut parameter used for host registration. This structured query pattern accompanies the pipe-delimited 101|GUID|VoYGkc5R check-in marker. Detecting it surfaces active Koi Loader C2 that precedes Koi Stealer deployment and credential exfiltration.

Suspicious Autorun Persistence Masquerading as Windows Security

This rule detects creation of a Run key value named Windows Security which the PXA Stealer campaign uses to disguise its autorun persistence as a legitimate security component. A benign looking value name combined with an autorun registry location is a common masquerading technique that warrants review of the referenced executable.

Suspicious Windows Service Creation via sc.exe

This rule detects creation of a new Windows service via sc.exe with a binary path argument. Adversaries register services for persistence and to execute payloads under SYSTEM. Because software installers also create services, review the binary path and service name for anomalies.

Malicious Payload Downloaded via PowerShell (via powershell)

This rule detects download a payload using PowerShell.

Malicious Boot Configuration Tampering via bcdedit (via process_creation)

This rule detects bcdedit commands that disable recovery options or manipulate boot configuration to support pre-OS persistence. DragonForce abuses bcdedit as part of a UEFI bootkit workflow and to inhibit Windows recovery, ensuring the compromise survives reboot and hampering remediation.

Possible NetHealth Implant C2 Beacon URI Pattern

This rule detects outbound HTTP requests matching the structured C2 beacon paths used by the Rapid Breach implant, including the resutato.com tap.php stager and the st.php beacon carrying computer and user name query parameters. These fixed URI patterns indicate command-and-control communication with the attacker infrastructure.

Suspicious Octo Tempest Remote Access and Tunneling Tooling (via process_creation)

This rule detects execution of remote monitoring and tunneling tools favored by Octo Tempest such as ScreenConnect Ngrok and Tailscale. The actor deployed these tools to maintain covert remote access and tunnel traffic out of victim networks.

Suspicious TruffleHog Secret Scanner Spawned by Node Package Manager on Linux

This rule detects the TruffleHog secret scanning tool being launched as a child of a node or npm process which the Shai-Hulud npm worm abuses during package install to locate GitHub npm and cloud credentials on the victim host. Running a credential scanner from within a package install lifecycle is anomalous and indicates automated secret theft rather than a developer audit.

Malicious spinstall0.aspx Webshell Written to SharePoint Layouts

This rule detects creation of the spinstall0.aspx webshell within the SharePoint LAYOUTS directory, the payload dropped by ToolShell exploitation to harvest machine key material. An aspx file written into the SharePoint application layouts path is a strong indicator of webshell installation.

Suspicious DLL Side-Loading via vssvc or WorkFolders

This rule detects the trusted binaries vssvc.exe or WorkFolders.exe loading a DLL from outside the Windows system directories. SideWinder abused DLL side-loading against these signed executables to run malicious code under a legitimate process, and loads from non-system paths indicate a planted DLL.

Malicious Follina MSDT Diagnostic Tool Code Execution (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool (msdt.exe) being invoked with Follina-style parameters such as PCWDiagnostic or IT_BrowseForFile, which the CVE-2022-30190 exploit uses to run attacker code from a weaponized document. MSDT abuse is a signed-binary code-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces document-driven exploitation before the payload executes.

Possible Host Port Scan from Single Source Address (via network_connection)

This rule detects a single source address initiating a high volume of TCP connections to many distinct destination ports on one host in a short window, indicating host port scanning. Observed in Elastic Security Labs detection engineering guidance where more than fifty distinct destination ports contacted rapidly reveals reconnaissance ahead of exploitation.

Suspicious SYSVOL Group Policy Preferences Access via Share Audit

This rule detects a user account reading machine level Group Policy Preferences files under the SYSVOL policies path through Windows detailed file share auditing as described in the WithSecure lab where GPP XML files were targeted for stored credentials. Interactive user access to machine policy XML files under SYSVOL frequently indicates hunting for cpassword secrets which is an early credential access and discovery signal.