Sigma detection rules, expert-reviewed

Suspicious Privileged Docker Container Mounting Host Filesystem

This rule detects a privileged Docker container being started with the host root filesystem bind-mounted into it, a configuration used to break container isolation and read host secrets. It is associated with software supply chain attacks that abuse developer and CI Docker access to reach host credentials. Detecting privileged host-mount launches flags container escape and credential access attempts.

Suspicious XDG Autostart Desktop Entry Persistence via DISGOMOJI

This rule detects creation of a .desktop autostart entry under the user config autostart directory as used by DISGOMOJI malware for Linux persistence. The malware placed a desktop entry to relaunch itself at login. Autostart entries are a common Linux user-level persistence mechanism.

Suspicious Azure CLI Disk Snapshot and Copy for Data Theft

This rule detects Azure CLI commands that create a managed disk snapshot or clone a disk from an existing source. It maps to cloud data theft where an attacker snapshots a target VM disk and attaches a copy to an unmonitored instance to read its contents. Detecting it exposes disk exfiltration through the cloud control plane.

Suspicious Scheduled Task Creation Launching a Script Interpreter (via process_creation)

This rule detects schtasks.exe creating a scheduled task whose action runs a command shell, PowerShell or another script interpreter or a payload from a user-writable path. Scheduled Task abuse is a top persistence and execution technique in the Red Canary Threat Detection Report, letting adversaries survive reboots and run code on a trigger. Detecting task creation that wraps an interpreter or suspicious path surfaces the persistence attempt as it is registered.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects the rclone utility being run with copy, sync or transfer-tuning flags that indicate bulk movement of files to a remote cloud endpoint. Emotet-related intrusions abuse rclone to exfiltrate collected data to attacker cloud storage before disruptive follow-on activity. Automated cloud transfers driven from an endpoint are a common precursor to extortion and should be reviewed.

MintsLoader AMSI Bypass via amsiInitFailed Reflection (via ps_script)

This rule detects the MintsLoader in-memory AMSI bypass that reflectively sets the amsiInitFailed field on the AmsiUtils type to disable the Antimalware Scan Interface before staging the next payload. Adversaries leverage this bypass to run malicious PowerShell content without scanning, making it a high-confidence defense-evasion indicator.

Malicious Hiloti Configuration Registry Key Creation (via registry_set)

This rule detects creation of the Bfetipi registry key under the Windows software hive, a configuration and persistence artifact of the Hiloti DNS-tunneling malware observed in Unit 42 daily tunneling detections. This non-standard key name is unique to the malware family and indicates infection.

Malicious Port Forwarding Tunnel via Netsh Portproxy (via process_creation)

This rule detects netsh interface portproxy commands that create a local port-forwarding tunnel, which adversaries use to relay traffic through a compromised host and reach otherwise unreachable internal systems. Netsh portproxy tunneling is a command-and-control and lateral-movement technique in the Red Canary Threat Detection Report. Detecting the tunnel setup surfaces network pivoting through the endpoint.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Malicious Perl Reverse Shell Execution on Linux

This rule detects a perl one liner that opens a network socket and connects back to a remote host and hands it to a shell which the opportunistic Log4j campaign uses to spawn an interactive reverse shell after exploiting a vulnerable server.

Malicious Firewall Rule Any/any Created (via firewall-as)

This rule detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.

Suspicious LaunchDaemon Persistence via plist Relocation

This rule detects a property list being moved into a LaunchDaemons directory, the persistence step used by OSX/Dummy to ensure its payload runs at boot with system privileges. Installing a plist into LaunchDaemons registers the malware with launchd for automatic execution.

Suspicious HijackLoader Connectivity Check to Apache Incubator Logo (via proxy)

This rule detects HTTP requests to the Apache incubator default.png logo path that HijackLoader uses as an internet connectivity check before contacting its command and control server. This exact static resource request from non browser processes is uncommon.

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious Windows Subsystem for Linux (WSL) Installation - PowerShell (via powershell)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.