Sigma detection rules, expert-reviewed

Suspicious schtasks Persistence Spawned from PowerShell or Script Chain

This rule detects schtasks creating a scheduled task when launched from a PowerShell or command-shell parent, a persistence step observed in the Suky Castle ClickFix-style campaign where an obfuscated PowerShell to cmd to attrib to schtasks chain established persistence. It captures scheduled-task creation originating from an interactive scripting context rather than an installer. Detecting this is important because attacker-driven schtasks activity typically descends from a script host rather than a legitimate management tool.

Malicious Directory Enumeration With Recon Tooling User Agent via Azure AD Graph

This rule detects Azure AD Graph requests carrying user agents belonging to known enumeration frameworks such as AzureHound BloodHound and AADInternals as described in Elastic research on AAD Graph activity logs. These tool signatures against the legacy Graph service indicate active directory reconnaissance for privilege escalation paths.

Suspicious Nmap Scripting Engine User-Agent in HTTP Requests (via webserver)

This rule detects HTTP requests carrying the Nmap Scripting Engine user-agent string, indicating automated NSE web probing against exposed services. Scanning activity of this kind precedes exploitation as adversaries enumerate service versions and vulnerabilities. Identifying the NSE user-agent surfaces active reconnaissance targeting internet-facing or ICS-adjacent web assets.

Suspicious Access To Chrome Credential Files

This rule detects read access to the Google Chrome Local State, Cookies and Login Data files by a process other than Chrome, captured via a SACL file audit and Security event 4663. In the WithSecure Windows Lab 4 tooling such as Chlonium or Mimikatz reads these files to steal the DPAPI master key and decrypt session cookies and stored passwords. Attackers harvest browser credentials and session tokens for account takeover.

Suspicious PowerShell Execution Referencing an AppData Path

This rule detects powershell.exe executing a command that references a user AppData path, a persistence pattern in which scheduled tasks or autoruns launch PowerShell payloads staged in AppData. This behavior helps hunt for script-based persistence that survives reboots.

Suspicious OpenClaw AI Agent Spawning Command Shell via Process Creation

This rule detects the OpenClaw AI agent binaries openclaw, clawdbot, or moltbot spawning a Unix command shell, the execution pattern that follows a poisoned agent skill being loaded. Adversaries plant malicious skills so the agent runs attacker commands with the user privileges, so an AI agent process launching sh, bash, or zsh is a strong sign of skill-based code execution.

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

This rule detects the ie4uinit LOLBIN being run with the -basesettings flag from a user-writable location such as AppData, the first-stage technique in the more_eggs TA4557 resume-lure intrusion where a copied ie4uinit loaded a malicious SCT through a planted ieuinit.inf. Adversaries relocate this signed binary to abuse its inf-driven command execution while evading path-based controls, so an out-of-System32 ie4uinit with -basesettings indicates staged code execution.

Malicious LSASS Memory Dump via comsvcs.dll MiniDump (via process_creation)

This rule detects credential theft where rundll32 invokes the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk, a technique observed in Akira ransomware intrusions. The resulting dump is later parsed offline to recover plaintext credentials and hashes.

Malicious Windows Defender Service Disable via sc.exe by Nova Ransomware

This rule detects sc.exe being used to disable the WinDefend service by setting its start type to disabled, a defense evasion step performed by Nova ransomware before encryption. Disabling the Defender service removes real-time protection from the host.

Suspicious Entra Device Code Authentication with Office Client and Automated User Agent

This rule detects Entra ID sign-ins using the device code authentication flow against the Microsoft Office client application from an automated python-requests user agent, matching the Kali365 device code phishing ecosystem. Adversaries phish device codes to obtain refresh tokens for the well-known Office client and replay them programmatically to access mailboxes. Device code flow paired with a scripted user agent is a strong indicator of token theft and mailbox compromise.

Coin Miner Masquerading as Misspelled svchost Process

This rule detects execution of processes named svhost.exe or svshost.exe, misspelled variants of the legitimate Windows svchost.exe. The GPU miner campaign ran its cryptomining payload under these typosquatted names to masquerade as a trusted system process. Any process using these near-identical names is almost certainly a masquerade attempt.

Malicious Shai-Hulud Data Exfiltration Script Execution via Process Creation

This rule detects execution of the .dev-env/config.sh helper script through bash, the staging and exfiltration routine dropped by the Shai-Hulud worm. The script bundles harvested secrets and pushes them to attacker infrastructure, so its execution indicates active collection and exfiltration on a compromised developer or build host.

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Suspicious Lock Screen Image Path Modification via Registry

This rule detects modification of the Windows lock screen image path registry value, a personalization change Qilin ransomware applied to display its ransom messaging. While policy tooling can set this value, an unexpected change alongside other intrusion signals indicates ransomware defacement.

Malicious PAM Configuration Tampering for Passwordless su via pam_rootok (via process_creation)

This rule detects modification of a PAM configuration file to insert the pam_rootok module, granting passwordless su to root. This technique was reported in the Group-IB XMRig covert Linux PAM abuse campaign as a stealthy privilege and persistence mechanism. Abusing pam_rootok lets an attacker escalate to root without credentials while evading authentication logging, making it a high fidelity indicator of compromise.