Sigma detection rules, expert-reviewed

Malicious NTDS Extraction via ntdsutil IFM (via process_creation)

This rule detects use of ntdsutil to create an Install From Media copy of the Active Directory database. Qilin ransomware operators ran ntdsutil with the ifm create full arguments to extract the NTDS database and registry hives for offline credential harvesting.

Suspicious MeshAgent Persistence via Scheduled Task MeshUserTask (via process_creation)

This rule detects creation of a scheduled task named MeshUserTask used to persist the MeshCentral MeshAgent remote management binary. Intrusion operators in the Anubis and Qilin ransomware campaigns installed MeshAgent for covert remote access and registered this task to survive reboots.

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

This rule detects execution of the cloudflared client establishing an outbound Cloudflare Tunnel. Operators behind the Anubis ransomware campaign dropped cloudflared to Windows and NAS hosts and ran it with tunnel and token arguments to create a persistent encrypted command and control channel that bypasses inbound firewall controls.

Suspicious RustDesk Remote Access Service Installation via sc (via process_creation)

This rule detects creation of a Windows service that launches RustDesk with an imported configuration. Akira ransomware operators installed RustDesk as an auto-start service using sc create to maintain unattended remote access to compromised hosts.

Malicious Windows Defender Tampering via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling multiple Microsoft Defender protection features in a single Set-MpPreference invocation. Akira ransomware operators ran this command to disable real-time, behavior, script and archive scanning before deploying tooling and the encryptor.

Malicious Service Creation Pointing to Public Data File via sc (via process_creation)

This rule detects creation of a Windows service whose binary path points to a .dat file staged under the Users Public directory. Operators exploiting ActiveMQ created a service named windowDefenSrv referencing a public payload file to gain persistence.

Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package fetched from a remote HTTP URL where the payload uses an image file extension. Operators exploiting CVE-2023-46604 delivered ransomware as MSI files named with a .png extension via msiexec quiet install.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

This rule detects creation of files within the Filegraber or decrypt_browser staging directories. The BoryptGrab-lineage infostealer wrote harvested browser data and logs to these folders, retaining the misspelled Filegraber directory name.

Malicious NTDS Database Staging to Audit Directory (via file_event)

This rule detects creation of an ntds.dit Active Directory database copy under a C drive audit Active Directory path. During the Anubis ransomware intrusion the operators exfiltrated domain credentials by copying the NTDS database into an audit directory and archiving it, an activity that does not occur during normal operations.

Suspicious Cleo Autorun Health Check File Drop (via file_event)

This rule detects creation of healthcheck.txt or healthchecktemplate.txt files inside a Cleo autorun directory. Operators exploited the Cleo autorun feature by writing these files to trigger execution of an embedded PowerShell stager.

Malicious Koske Persistence via Systemd Service and Shell Profile Hijack (via process_creation)

This rule detects Koske establishing persistence by registering the shellkoske systemd service and by deploying a hijacked shell profile named .bashrc.koske that beacons to command and control. These named artifacts are unique to the Koske campaign and do not appear in legitimate software.

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

This rule detects the Apache Tomcat cryptomining campaign fetching a payload and piping it through several chained base64 decode passes before executing it with bash. Repeated base64 decode stages in a single command line indicate deliberate obfuscation and are not typical of legitimate administration.

Malicious Sobolan Payload Download from Jupyter Compromise (via process_creation)

This rule detects retrieval of the Sobolan archive from the hidden .sobo path on the attacker download server using wget or curl after an unauthenticated JupyterLab instance is compromised. The .sobo/temp.tar path is specific to this campaign.

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

This rule detects execution of the TeamTNT Docker Gatling Gun initialization scripts TDGGinit.sh and TDGG.sh that are deployed inside compromised containers to harvest cloud credentials, add hosts to an attacker Docker Swarm and deploy cryptominers. These script names are specific to the campaign.