Sigma detection rules, expert-reviewed

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Suspicious Lock Screen Image Path Modification via Registry

This rule detects modification of the Windows lock screen image path registry value, a personalization change Qilin ransomware applied to display its ransom messaging. While policy tooling can set this value, an unexpected change alongside other intrusion signals indicates ransomware defacement.

Malicious PAM Configuration Tampering for Passwordless su via pam_rootok (via process_creation)

This rule detects modification of a PAM configuration file to insert the pam_rootok module, granting passwordless su to root. This technique was reported in the Group-IB XMRig covert Linux PAM abuse campaign as a stealthy privilege and persistence mechanism. Abusing pam_rootok lets an attacker escalate to root without credentials while evading authentication logging, making it a high fidelity indicator of compromise.

Malicious Vulnerable Driver Load for BYOVD Defense Evasion (via image_load)

This rule detects loading of the rwdrv.sys, hlpdrv.sys and churchill_driver.sys kernel drivers abused in bring-your-own-vulnerable-driver attacks. Akira ransomware operators loaded these drivers to disable endpoint protection and tamper with security product access controls prior to encryption.

Possible Log4Shell JNDI Injection in HTTP Request

This rule detects JNDI lookup strings in HTTP request URIs or fields, indicative of Log4Shell (CVE-2021-44228) exploitation attempts against Log4j. Attackers embed jndi:ldap, jndi:rmi, or jndi:dns references, often inside headers such as X-Api-Version, to force the vulnerable logger to fetch and execute a remote class.

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

This rule detects GCP storage bucket deletion operations that enable universal bucket hijacking, where an attacker recreates a same-named bucket in another account to intercept data. This tactic redirects storage transfer, pubsub, and logging outputs to adversary-controlled resources.

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

This rule detects deployment of the vulnerable drivers aswArPots.sys and IObitUnlockers.sys that GHOSTENGINE abuses to terminate endpoint security processes and delete their binaries. These bring-your-own-vulnerable-driver components provide kernel-level primitives to disable defenses. Their presence indicates an active attempt to blind security tooling.

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

This rule detects the sshd process loading the backdoored liblzma shared object versions 5.6.0 or 5.6.1 associated with the XZ Utils supply chain compromise. Wiz Research described how this library hooks RSA_public_decrypt to grant remote code execution, so loading these specific versions indicates a compromised host.

Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE

This rule detects reconfiguration of the SessionEnv or IKEEXT services via sc config, a technique the EAGERBEE backdoor uses to load a malicious service DLL such as tsvipsrv.dll. These services are known targets for phantom-DLL loading under svchost. Modifying their binary path or service DLL indicates service hijacking for persistence.

Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy

This rule detects an IAM AttachUserPolicy call that attaches an administrator managed policy to a user, a technique used by operators of exposed IAM keys tracked by Unit 42 to escalate privileges before launching cryptojacking instances. Attackers abuse leaked long-term keys to grant themselves full control of the account which enables large scale resource abuse.

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Malicious PowerShell In-Memory Download Cradle via IEX DownloadString

This rule detects PowerShell invoking IEX together with a Net.WebClient DownloadString call to fetch and execute code directly in memory. This tradecraft was used by APT41 to stage ShadowPad and Cobalt Strike against a Taiwanese government-affiliated research institute. In-memory download cradles let attackers run remote payloads without writing them to disk which frustrates file-based detection.

Suspicious LucidRook DLL Side-Loading via Renamed msedge.exe

This rule detects msedge.exe executing from a WindowsApps directory under the user profile, matching the LucidRook loader that renames the DISM index.exe binary to msedge.exe to side-load a malicious DismCore.dll. Legitimate Microsoft Edge runs from Program Files, so an msedge.exe launched from AppData WindowsApps is an impostor used for search-order hijacking. This behavior indicates initial execution of the Lua-based LucidRook malware.

Possible Telegram Bot API Command and Control Channel

This rule detects DNS resolution of the Telegram bot API host api.telegram.org. QwixxRAT and similar stealers abuse the Telegram Bot API as a command-and-control and exfiltration channel to receive commands and upload stolen data. Because legitimate Telegram clients also resolve this host this signal should be correlated with unexpected processes making the query.

Office Persistence via WLL Add-in Dropped to Word STARTUP Folder

This rule detects a .wll Word add-in written to the Microsoft Word STARTUP folder, the persistence mechanism used by the PortDoor backdoor against the Russian defense sector. Word automatically loads WLL add-ins from this folder at launch, giving attackers stealthy code execution on every Word start.