Sigma detection rules, expert-reviewed

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

This rule detects use of rar to build an archive while deleting source files after archiving, a collection and staging technique used by CL-UNK-1068 to compress stolen data into files such as host.rar prior to exfiltration. The delete flag reduces on-disk footprint and reflects deliberate staging of collected data.

Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)

This rule detects the hardcoded FRP authentication token frpforzhangwei used by CL-UNK-1068 to establish fast reverse proxy tunnels into victim networks. This unique token constant identifies the actor's tunneling infrastructure, providing persistent encrypted access for command and control and lateral movement.

Suspicious Extraction of PuTTY SSH Host Keys via Reg Export (via process_creation)

This rule detects export of the PuTTY SshHostKeys registry key, used by CL-UNK-1068 to harvest cached SSH host key material for lateral movement to Unix and network infrastructure. Recorded SSH host keys reveal previously accessed remote systems, so this extraction supports pivoting deeper into the environment.

Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)

This rule detects enumeration of IIS sites, virtual directories, and application pools using appcmd, a discovery behavior used by the CL-UNK-1068 cluster during long-running operations against high-value sectors. Attackers use this reconnaissance to map web application deployment for webshell placement and lateral movement, making it an early indicator of hands-on-keyboard activity.

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an Install From Media snapshot of the Active Directory database, a credential access technique used by actors following BeyondTrust CVE-2026-1731 exploitation. The IFM snapshot exports the NTDS.dit hive containing domain password hashes, enabling full domain compromise, so this activity should be treated as active credential theft.

Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)

This rule detects the BeyondTrust Bomgar remote support agent spawning a command shell, a behavior observed during exploitation of critical vulnerability CVE-2026-1731 by actors deploying VShell and SparkRAT. The remote support binary should not launch cmd.exe or powershell.exe, so this chain indicates remote code execution against the appliance and warrants immediate response.

Suspicious ESXi Management Agent Stop via vpxa init Script (via process_creation)

This rule detects stopping the ESXi vpxa management agent through its init.d script, an evasion step in the RansomHouse MrAgent playbook that severs vCenter oversight before ransomware runs. Disabling vpxa blinds central management while the host is encrypted.

Malicious ESXi Firewall Disable via esxcli (via process_creation)

This rule detects the esxcli command that disables the ESXi host firewall, a defense-evasion action performed by the RansomHouse MrAgent tool before mass VM encryption. Turning off the hypervisor firewall opens management and lateral-movement paths ahead of the Mario ransomware deployment.

Malicious Reverse Shell via bash dev tcp Redirection (via process_creation)

This rule detects an interactive bash reverse shell that redirects a session over the /dev/tcp pseudo-device, delivered after exploitation of the React Server Components vulnerabilities. The one-liner opens a network socket back to the attacker for hands-on-keyboard control of the compromised server.

Malicious Command Injection Probe via node Spawning Shell Arithmetic Echo (via process_creation)

This rule detects a node process spawning /bin/sh to echo an arithmetic expression, the validation probe used when exploiting the React Server Components vulnerabilities CVE-2025-55182 and CVE-2025-66478. Attackers confirm remote command execution by evaluating a math expression through the injected shell before delivering payloads.

AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock

Alerts when CloudTrail shows S3 Block Public Access settings being weakened (set to false) in PutBucketPublicAccessBlock with Success.

Suspicious Data Exfiltration via Rclone Cloud Transfer (via process_creation)

This rule detects Rclone copying or syncing data to a remote backend, the exfiltration tool used by the Ashen Lepus AshTag operators to move staged diplomatic data to attacker cloud storage. Rclone copy and sync operations bulk-transfer collected files off the host to web services.

Malicious Scheduled Task Masquerading as Windows Defender Updater (via process_creation)

This rule detects creation of a scheduled task named to impersonate Windows update or Defender maintenance, a persistence technique used by the Hamas-affiliated Ashen Lepus AshTag malware suite. The benign-looking task names Windows Defender Updater and Automatic Windows Update disguise attacker-controlled recurring execution.

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

This rule detects a self-deletion chain that pings the 127.0.0.7 loopback address as a timing delay before force-deleting a file, a cleanup routine used by the 01flip ransomware to remove its own binary after execution. Chaining ping to loopback with del /f /q lets the malware wait for its parent to exit and then erase traces.

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

This rule detects use of fsutil setZeroData, which overwrites file regions with zeros to prevent forensic recovery, a self-delete and anti-recovery step in the 01flip Rust ransomware Windows chain. The technique destroys the original binary and data remnants after encryption to inhibit recovery and analysis.