Sigma detection rules, expert-reviewed

Suspicious GitHub CLI Auth Token Extraction via Command Line

This rule detects invocation of the GitHub CLI to print the stored authentication token, a step malicious npm packages use to exfiltrate a developer GitHub session after a build. In the tracked npm supply chain attacks this token theft follows a bun-triggered install hook. Detecting the token dump surfaces credential access that enables repository compromise and further supply chain abuse.

Suspicious Advanced IP Scanner Execution for Network Discovery

This rule detects execution of Advanced IP Scanner, a dual-use network mapping tool frequently staged by ransomware crews to enumerate reachable hosts before lateral movement. The Gentlemen ransomware operators run it during the discovery phase of their intrusions. Detecting it in unexpected contexts can reveal pre-encryption reconnaissance.

Malicious Scheduled Task Named Gentlemen via Schtasks

This rule detects creation of a scheduled task named gentlemen, the persistence marker used by The Gentlemen ransomware operators. The task re-launches ransomware tooling across reboots during the intrusion. Detecting this named task provides a high-confidence indicator tied directly to the campaign.

Suspicious MicrosoftEdgeUpdate Launched with Dat Config File

This rule detects MicrosoftEdgeUpdate.exe being started with a --config argument pointing at a .dat file, a pattern the legitimate Edge updater never uses. The Vidar campaign abuses the trusted Edge updater name to sideload a payload configured from a data file such as mgwthmc2.dat. Detecting this unusual argument reveals a masqueraded loader riding a signed updater filename.

Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks

This rule detects creation of a scheduled task named SystemAgentService that launches a NisSrv.exe payload at user logon. The Vidar stealer and XMRig miner campaign registers this task to masquerade its persistence as the Microsoft Defender network inspection service. Detecting the fake service task exposes a logon-triggered foothold impersonating a security component.

Suspicious Choice Command Self-Destruct Delete Loop via Command Line

This rule detects use of the built-in choice.exe utility as a timing gate chained with a delete command, a self-destruct pattern that waits before removing the dropper to erase traces. CL-STA-1062 uses choice.exe delays to self-delete its staging binaries after execution. Detecting this timed cleanup reveals anti-forensic behavior that removes evidence of the intrusion.

Suspicious Base64 Decoded Shell Dropper via Command Line

This rule detects a base64 encoded blob being decoded on the command line and piped straight into a shell interpreter. The OpenClaw AI supply chain campaign hides its curl-based droppers inside base64 to evade string based inspection before executing macOS stealer code. Catching this decode-and-run chain reveals obfuscated execution that static content filters miss.

Suspicious Execution of PAN-OS Captive Portal Implant Binaries (via process_creation)

This rule detects execution of implant binaries dropped during exploitation of the PAN-OS Captive Portal zero-day, staged under /var/tmp as linuxap, linuxda, or linuxupdate. These files provide attacker foothold and follow-on tooling on the compromised firewall.

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

This rule detects curl or wget retrieving content from the copy.fail exploit host used in CVE-2026-31431 Copy Fail attacks. The downloaded exploit is followed by su-based privilege escalation to root on the compromised Linux system.

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

This rule detects the su binary being launched by a parent process that is not a common interactive shell or sudo, a privilege-escalation pattern tied to CVE-2026-31431 Copy Fail exploitation. Attackers invoke su from non-shell contexts to elevate to root after gaining initial code execution.

Possible Mirai IoT Payload Staging via chmod on Linux (via process_creation)

This rule detects chmod granting full 777 permissions to downloaded payloads in world-writable directories or files named after CPU architectures, a staging step used after exploiting CVE-2023-33538. This behavior precedes execution of Condi or Mirai IoT bot binaries dropped via wget on compromised routers.

Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)

This rule detects an executable named wt.exe running from a ProgramData path, a masquerade used in the Axios supply chain attack where PowerShell was copied to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal. The legitimate Windows Terminal never runs from ProgramData, so this location indicates a relocated payload used to evade detection.

Suspicious Python Base64 Encoded Command Execution (via process_creation)

This rule detects Python decoding and executing a base64-encoded payload inline, an execution technique used in the TeamPCP multi-stage supply chain attack on security infrastructure. Combining base64 decoding with dynamic exec obscures the executed code and is characteristic of staged malicious payloads rather than normal application behavior.

Suspicious GoogleUpdate Binary Executing From Non-Standard Path (via process_creation)

This rule detects the GoogleUpdate.exe binary running from a path outside the standard Google installation directories, a masquerade used by threat clusters targeting a Southeast Asian government organization to sideload malicious DLLs under a trusted process name. A trusted updater executing from an unexpected location indicates the binary was relocated to abuse DLL search-order hijacking.

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

This rule detects the distinctive cmd.exe flag combination /e:ON /v:OFF /d /c used by the LampoRAT command dispatcher attributed to Boggy Serpens. This precise switch pattern is atypical of interactive or scripted administration and reflects the implant executing operator commands on the host.