Sigma detection rules, expert-reviewed

Suspicious Linux Log Sanitization via sed In-Place Edit

This rule detects sed being used to edit web and appliance log files in place, matching OVERSTEP anti-forensic behavior that strips attacker artifacts from SonicWall SMA logs. Selective log tampering conceals exploitation and backdoor activity from responders.

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

This rule detects the creation of a DLL under the non-standard C\assembly\tmp staging directory used by the DCOM Upload and Execute backdoor documented by Deep Instinct. The backdoor abuses the DCOM MSI install server to upload and load a managed assembly for remote code execution. Detecting this drop exposes lateral tool transfer before the payload is loaded into a victim process.

Malicious DeceptiveDevelopment Defender Exclusion for Coin Miner via PowerShell

This rule detects PowerShell adding Microsoft Defender exclusions for cryptomining components used by the DeceptiveDevelopment cluster after a ClickFix fake-interview lure. Attackers whitelist TsunamiClient and XMRig paths so the dropped miners run undetected, and matching this behavior surfaces active defense evasion before mining begins.

Suspicious Domain Controller and Trust Enumeration via Nltest

This rule detects nltest enumerating domain controllers or domain trusts which the BlackSuit ransomware actor used to map the environment before lateral movement and this matters because bulk trust and DC listing through nltest is a frequent discovery step in intrusions and stands out against sparse legitimate use on endpoints.

Suspicious COLDRIVER Fileless Payload Storage in Explorer CLSID DefaultIcon (via registry_set)

This rule detects registry writes storing encrypted payload data in the Explorer CLSID DefaultIcon subkey using the EnthusiastMode and QatItems values as done by the COLDRIVER SIMPLEFIX loader. Storing binary blobs in this location is a fileless evasion technique.

Suspicious Hidden Encoded PowerShell Launching Node.js Runtime

This rule detects PowerShell invoked with hidden window style and an encoded command that launches node.exe, a loader chain used by the Tsundere Node.js botnet. The malware uses powershell -WindowStyle Hidden -NoLogo -enc to decode and start its Node.js payload out of sight. Combining hidden execution and base64 encoding to bootstrap a Node runtime is a strong indicator of malicious loader activity.

Suspicious Service Registration Loading Vulnerable Driver

This rule detects registry service registration where the ImagePath points to a known vulnerable kernel driver filename which adversaries create to load an exploitable driver into the kernel during bring your own vulnerable driver attacks. Creation of a service that maps to these driver binaries indicates staging of a kernel level defense evasion or privilege escalation capability.

Suspicious tapiperf.dll Load by WMI Provider Host via Image Load

This rule detects wmiprvse.exe loading tapiperf.dll, which the Lunar toolset abuses through DLL replacement to gain execution inside a trusted Windows process. Legitimately tapiperf.dll is a TAPI performance counter library and is not loaded by the WMI provider host. This anomalous load points to DLL hijacking used for stealthy persistence and code execution.

Suspicious AWS Console AiTM Phishing Kit API Endpoints

This rule detects requests to the AWS console phishing kit API endpoints that relay login attempts using its distinctive input_24 parameter. The adversary-in-the-middle kit proxies AWS console authentication through check, login, and auth routes to capture credentials in real time. Traffic to these kit endpoints carrying the input_24 field indicates victims interacting with the AWS console phishing infrastructure.

Suspicious Firewall Rule Opening Backdoor Port 49683 via Process Creation

This rule detects a netsh advfirewall command that adds a rule for local port 49683. ToddyCat opens this specific port to expose its passive UDP backdoor (aspnet.exe) for command-and-control, so a firewall rule referencing it indicates attacker setup.

Suspicious Service Creation Masquerading as FortiGateUpdate (via process_creation)

This rule detects sc.exe creating a service named FortiGateUpdate whose binary path launches svchost with a service grouping switch. This behavior was observed in Cyber Partisans activity that masqueraded a DNSCat2 tunneling service as a Fortinet update to blend into industrial environments. Detecting the masqueraded service creation exposes the persistence stage of the intrusion.

ClickFix macOS Payload Retrieval via curl Insecure Flags Piped to Shell (via process_creation)

This rule detects the macOS ClickFix chain where curl downloads a payload with insecure combined flags and pipes it directly into a shell for execution. Adversaries leverage the kfsSL flag bundle to silently bypass TLS validation and follow redirects before running the fetched script, making the curl-piped-to-shell pattern a high-confidence execution indicator.

Malicious Cloud Storage Destruction by Cloud Build Service Account

This rule detects a Google Cloud Build default service account invoking storage bucket or object deletion which was abused to destroy data by triggering builds that ran attacker controlled steps. Destructive storage operations originating from a cloudbuild or compute default service account rather than a human principal indicate potential data destruction through the Cloud Build pipeline.

Suspicious wscript Execution of Short-Name JavaScript from AppData (via process_creation)

This rule detects GootBot persistence where a scheduled task runs wscript.exe against a second-stage JavaScript file using its short name ending in a tilde-one JS pattern inside an AppData subfolder. Execution of a short-name js from AppData by the script host is characteristic of the GootLoader chain. Legitimate software rarely launches scripts this way.

Suspicious SD-WAN Compromise Reverse Tunnel via gsocket

This rule detects execution of the gsocket or gs-netcat tunneling utilities, matching the Cisco Catalyst SD-WAN exploitation where operators deploy gsocket to establish an outbound relay through firewalls. The Global Socket toolkit provides resilient encrypted access that bypasses inbound restrictions on compromised network devices. Presence of these tools on an appliance indicates covert remote access.