Sigma detection rules, expert-reviewed

Suspicious Hidden Window PowerShell with Modified Execution Policy (via process_creation)

This rule detects PowerShell launched with a hidden window and a bypassed or relaxed execution policy in a single command line. DragonForce and many ransomware loaders use this combination to run staging scripts silently, evading user awareness and default script-execution restrictions.

Suspicious Chrome Remote Desktop Host Silent Binding for Remote Access (via process_creation)

This rule detects headless registration of a Chrome Remote Desktop host using the start host binary with authorization code redirect and pin arguments, the remote access tool abuse observed in a Kimsuky campaign to obtain interactive control of victim machines. Adversaries leverage legitimate remote desktop software to blend with sanctioned IT tooling while retaining hands on keyboard access, making early detection critical for exposing unauthorized remote sessions.

Suspicious AiTM Phishing Kit Session Validation Endpoint via Proxy

This rule detects web requests to reverse-proxy adversary-in-the-middle phishing kit endpoints, specifically the check_response handler carrying a session_id parameter alongside kit paths such as api/login, 2fa, sms and tap. It is associated with the Operation Fake KickOff campaign that abused recruiters and SaaS services to harvest corporate credentials and relay multi-factor authentication tokens. Detecting these structured kit paths surfaces live credential and MFA session theft.

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

This rule detects the VMware Tools guest process vmtoolsd.exe spawning a command interpreter such as cmd.exe or powershell.exe. Fire Ant abused hypervisor level access and CVE-2023-20867 to execute commands inside guest virtual machines from a compromised ESXi host, producing an unusual parent-child chain that does not occur during normal VMware Tools operation.

Malicious Local Administrator Added by Atera RMM Agent

This rule detects the AteraAgent process spawning net.exe to add an account to the local administrators group, an abuse chain Huntress observed during bulk attacks leveraging RMM tools against MSP-managed endpoints. Attackers who gain access to an RMM tenant push commands that create privileged accounts for persistence. Privileged account changes originating from an RMM agent are a strong indicator of tenant abuse.

Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)

This rule detects execution of an image whose name ends in a data-to-executable double extension such as .dat.exe, matching the STOCKSTAY chain where an HTA renamed a styles.dat payload to styles.dat.exe and ran it through WScript.Shell. Adversaries use double extensions to disguise executable payloads as inert data files, so running such a file is a strong masquerading indicator.

Suspicious FatalRAT Keylog File Creation in Windows Directory (via file_event)

This rule detects creation of the FatalRAT keylog artifact Fatal.key in the Windows directory. This behavior was observed in Operation SalmonSlalom where the backdoor recorded captured keystrokes to a fixed file for later collection. Detecting this artifact reveals credential and input capture activity on the host.

Malicious SUGARLOADER Configuration Masquerading as Safari Cache via File Event

This rule detects creation of a com.apple.safari.ck file in the Library Caches directory which is the RC4 encrypted configuration written by the SUGARLOADER stage of the KANDYKORN intrusion. The filename masquerades as a legitimate Safari cache to hide malware configuration on macOS hosts.

Suspicious WordPress Web Shell Drop in Plugins Directory (via file_event)

This rule detects creation of a PHP web shell file whose name contains shell inside the WordPress plugins directory, matching the compromised-container forensics case that recovered a rshell.php web shell. Attackers drop such files to keep code-execution access to a web application. A shell-named PHP file written under wp-content plugins is a strong web shell indicator.

Malicious Ivanti EPMM Exploitation via appstore fob Endpoint (via webserver)

This rule detects requests to the Ivanti EPMM exploit endpoints under the appstore and aftstore fob paths, the access pattern used to trigger CVE-2026-1281 and CVE-2026-1340. Hitting these routes drives unauthenticated code paths that lead to JSP webshell deployment and reverse shells.

Suspicious rclone Masquerading as Avast Binary by The Gentlemen RaaS (via process_creation)

This rule detects execution of a binary named avastrclone.exe, the renamed rclone client The Gentlemen operators disguise as an Avast component to blend in while exfiltrating data over cloud storage. The masqueraded name combines a legitimate-looking brand with an untrusted tool. Detecting it exposes covert bulk exfiltration.

Suspicious User and Network Namespace Creation via unshare on Linux

This rule detects use of unshare to create combined user and network namespaces as leveraged by the Copy Fail and DirtyFrag Linux page cache exploits in Elastic research. Unprivileged user namespace creation is a common precursor to kernel exploitation that grants capabilities inside the new namespace for privilege escalation.

Suspicious Edgecution Decryption Key Storage in Edge AppKey Value (via registry_set)

This rule detects creation of a non standard AppKey value under the HKCU Microsoft Edge key where Edgecution stores the hex string used to decrypt strings inside its Python backdoor. The genuine Edge configuration does not use an AppKey value in this location.

Malicious Shadow Copy Deletion via vssadmin Delete Shadows (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly, the inhibit-recovery step in the RansomHub intrusion performed alongside log clearing before encryption. Adversaries destroy shadow copies so victims cannot restore files without paying, so this command outside a maintenance window is a strong pre-encryption impact indicator.

Suspicious UAT-8302 Scheduled Task Creation for Recon Tooling

This rule detects schtasks creating tasks named ReconLiteDebug or RunWhatPC, matching the UAT-8302 persistence that schedules its host-profiling and command tooling under recognizable task names. These campaign-specific task names betray the attacker even when the underlying payload is renamed. Presence of either scheduled task indicates UAT-8302 foothold and tasking.