Sigma detection rules, expert-reviewed

Suspicious Proxyware Download to Hidden Tmp Path on Linux

This rule detects wget fetching a payload into the hidden /tmp/logs/.config/whatchdog location used to stage residential proxyware on compromised Linux hosts. Downloading an executable into a concealed tmp directory is a strong indicator of proxyware staging.

Suspicious Hidden PowerShell Download Cradle via IEX (via process_creation)

This rule detects a hidden-window PowerShell process using a download cradle and IEX to execute remote content in memory. Amatera Stealer ClickFix lures pasted this pattern to pull and run the next stage.

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

This rule detects the MSSQL server process sqlservr.exe spawning a command interpreter, indicating xp_cmdshell abuse for operating system command execution as seen in the printer-and-BitLocker extortion scheme. Attackers exploiting exposed MSSQL instances use this to run arbitrary commands and stage further tooling on the host.

RedDelta MSI Installation via Hidden PowerShell WindowsInstaller COM Object (via process_creation)

This rule detects the RedDelta delivery command that drives a hidden PowerShell process to instantiate the WindowsInstaller COM object and silently install a remote MSI with REMOVE=ALL. Adversaries leverage the scripted installer COM interface to fetch and run payloads while suppressing the installer UI, making this command pattern a strong execution indicator.

Suspicious Payload Download and Execution via curl chmod 777 (via process_creation)

This rule detects a download-and-run chain that fetches a file with curl or wget and marks it world-executable with chmod 777 before running it, the delivery routine used after exploiting the React Server Components flaws to stage XMRig, Mirai and Cobalt Strike CrossC2. Chaining retrieval, permission change and execution stages a remote binary on the compromised host.

Suspicious Mshta Autorun Persistence via Registry Set

This rule detects a Run key value pointing to mshta.exe, the registry persistence UAT-11795 plants to relaunch its Starland RAT loader at logon as reported by Cisco Talos. A HKCU Run entry that invokes mshta is highly atypical of legitimate software. Detecting it exposes autorun persistence tied to the script-based loader.

Suspicious Boto3 Kali Linux User Agent in AWS CloudTrail Reconnaissance (via cloudtrail)

This rule detects AWS CloudTrail activity from the specific Boto3 1.42.73 build running on Kali Linux that TeamPCP used to enumerate IAM EC2 Lambda and Secrets Manager resources after stealing credentials. The pairing of this SDK version with a Kali offensive distribution user agent is a strong indicator of hands-on-keyboard cloud reconnaissance with stolen keys.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious UpdatusUser Local Account Creation by Secret Blizzard

This rule detects creation of a local account named UpdatusUser via net user. Microsoft attributed this masquerading account name to Secret Blizzard establishing persistence during its AiTM campaign. The name mimics a legitimate updater service but is created interactively, so this specific account name is a high-confidence persistence indicator.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation

This rule detects PowerShell script content that disables the Antimalware Scan Interface by reflecting into System.Management.Automation.AmsiUtils and setting the amsiInitFailed field to true. This in-memory AMSI bypass was observed during React2Shell CVE-2025-55182 exploitation to blind endpoint scanning before executing follow-on payloads.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Caching

This rule detects the WDigest UseLogonCredential registry value being set to 1, forcing Windows to cache plaintext credentials in memory as documented by Huntress. Attackers enable this setting before dumping LSASS so that cleartext passwords are recoverable. This modification undermines credential protection and is a strong precursor to credential harvesting.

Suspicious Cloudflare Quick Tunnel Establishment via trycloudflare.com (via process_creation)

This rule detects establishment of a Cloudflare quick tunnel referencing trycloudflare.com, an anonymous tunneling channel abused after React2Shell exploitation to reach compromised servers without exposing attacker infrastructure. Adversaries use these ephemeral tunnels to proxy command and control and remote access through trusted Cloudflare domains, so their presence on a server signals covert external connectivity.

Suspicious Windows Firewall Disabled via netsh by BlackByte Ransomware

This rule detects netsh disabling all Windows Firewall profiles, a defense evasion action used by BlackByte ransomware to remove network restrictions before spreading. Turning off all firewall profiles is rarely legitimate on managed endpoints.

Suspicious Hidden Window PowerShell with Modified Execution Policy (via process_creation)

This rule detects PowerShell launched with a hidden window and a bypassed or relaxed execution policy in a single command line. DragonForce and many ransomware loaders use this combination to run staging scripts silently, evading user awareness and default script-execution restrictions.