Sigma detection rules, expert-reviewed

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

This rule detects the SharePoint IIS worker process w3wp.exe spawning cmd.exe or powershell.exe. Exploitation of the ToolShell SharePoint vulnerabilities results in the web worker launching shells to run base64 encoded commands. A web server process parenting an interactive shell strongly indicates webshell or exploitation activity.

Suspicious SSH Reverse Tunnel Over DNS Port

This rule detects the ssh client establishing a reverse tunnel bound to port 53. Actors compromising telecom providers route SSH reverse tunnels over the DNS port to evade egress filtering. A remote-forward SSH session using port 53 is highly abnormal and indicates covert tunneling.

Malicious Service Persistence via sc.exe Creating msdnetsvc

This rule detects sc.exe creating a Windows service named msdnetsvc. This service name is used by the backdoor targeting Southeast Asian governments to gain persistence and survive reboots. A named service with this masquerading identity is a high-confidence indicator of the intrusion.

Suspicious curl Spawning Script Host for Latrodectus Delivery

This rule detects curl.exe spawning the Windows script host to run JScript or VBScript. The ClickFix to Latrodectus infection chain uses curl to fetch a JavaScript payload which is then executed via cscript. Download utility parenting a script interpreter is highly abnormal on endpoints and marks a malware staging step.

Suspicious PowerShell Execution via Forfiles LOLBIN

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Suspicious Scheduled Task Masquerading as Palo Alto Cortex Services

This rule detects creation of a scheduled task named to impersonate Palo Alto Cortex security services. Threat actors targeting African financial institutions used this task name to disguise persistence for their tooling. A security-vendor-themed task name created through schtasks is a masquerading persistence indicator.

Suspicious File Download via Certutil URLCache

This rule detects the certutil utility used with urlcache to download a remote file over HTTP, a living-off-the-land technique seen after CVE-2025-31324 exploitation of SAP NetWeaver. Attackers use certutil to retrieve second-stage payloads while evading application controls. This LOLBIN download behavior is rarely legitimate on servers.

Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog

This rule detects PowerShell spawned from the Windows Run dialog that combines Invoke-WebRequest with Start-Process to download and launch a payload. This pattern is used by the Lampion banking malware ClickFix campaign that tricks users into pasting a malicious one-liner. Attackers abuse this social-engineering vector to gain initial code execution while blending into normal user activity.

Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)

This rule detects creation of a scheduled task named w32analytics that executes rundll32 against w32analytics.dll, a persistence mechanism observed in recent unusual malware analyzed by Unit 42. Combining scheduled task persistence with rundll32 proxy execution lets the loader run its DLL export on a recurring basis while evading direct binary controls.

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

This rule detects the renamed Windows debugger cdb.exe masquerading as fontdrvhost.exe in C:\ProgramData and loading shellcode from config.ini, a loader used by the Squidoor backdoor. Running the signed cdb LOLBin under a spoofed name from a non-standard path proxies malicious code execution past application controls.

Malicious curl Download From Fake Apple Ads Domain on macOS (via process_creation)

This rule detects curl retrieving payloads from the apple-ads-metric staging domain used to deliver npm and back.sh second-stage scripts in the macOS crypto-sector intrusion. Downloading follow-on tooling from this Apple-themed domain marks the ingress tool transfer stage of the attack.

Malicious curl Exfiltration to Attacker Upload Endpoint on macOS (via process_creation)

This rule detects curl multipart form uploads to the /tasks/upload_file endpoint used by a North Korea-linked actor to exfiltrate stolen files from macOS crypto-sector targets. The RustDoor and Koi Stealer chain uploads harvested credentials and wallet data to attacker-controlled servers such as visualstudiomacupdate over this path.

Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)

This rule detects modification of /etc/ld.so.preload to load libcext.so.2, the shared object used by the Auto-Color backdoor to hook libc functions and hide its network connections. This dynamic linker hijack provides rootkit-like concealment and persistence across all dynamically linked processes.

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

This rule detects processes referencing the /Users/Shared/NW staging directory used by the Cthulhu macOS stealer to collect harvested data before exfiltration. Use of this world-writable shared path for staging is a strong indicator of stealer activity preparing collected browser and wallet data.

Suspicious MSBuild Inline Task Compilation of mini.xml

This rule detects MSBuild executing the project file mini.xml to compile and run inline code. This behavior matches post-exploitation of Ivanti CVE-2025-0282 where a msbuild.lnk shortcut invoked MSBuild as a trusted developer utility to execute attacker code. MSBuild compiling arbitrary XML project files is a proxy execution technique used to bypass application controls.