Sigma detection rules, expert-reviewed

Suspicious MSBuild Inline Task Compilation of mini.xml

This rule detects MSBuild executing the project file mini.xml to compile and run inline code. This behavior matches post-exploitation of Ivanti CVE-2025-0282 where a msbuild.lnk shortcut invoked MSBuild as a trusted developer utility to execute attacker code. MSBuild compiling arbitrary XML project files is a proxy execution technique used to bypass application controls.

Suspicious AdFind Domain User Reconnaissance Output

This rule detects command lines writing to the reconnaissance output file Domain_users_light.txt associated with AdFind based Active Directory enumeration. This behavior matches intrusions that rename AdFind to a.logs and dump domain user objects for targeting. Structured directory enumeration output is a discovery indicator that commonly precedes lateral movement and Kerberoasting.

Malicious Container Escape via chroot to Host Mount

This rule detects a process invoking chroot into a mounted host filesystem path from within a privileged container. This behavior matches Dirty DAG where an attacker ran a privileged pod that mounted and chrooted into the underlying node to escape the container. Chrooting into a host mount is a definitive container escape technique granting node-level control.

Malicious ESXi Syslog Redirection to tmp via esxcli

This rule detects reconfiguration of the ESXi syslog log directory to a volatile tmp location via esxcli. This behavior matches Akira ransomware operators targeting VMware ESXi who redirect logs to erase forensic evidence before encrypting virtual machines. Pointing syslog at tmp destroys audit trails and is a defense evasion step tied to hypervisor-level ransomware attacks.

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Malicious NTDS Database Dump via ntdsutil

This rule detects use of ntdsutil to create a full copy of the Active Directory NTDS.dit database. This behavior matches BlackSuit ransomware operators who dump the domain credential store for offline extraction of password hashes. Access to NTDS.dit enables domain-wide credential compromise and is a high-severity precursor to lateral movement and full domain takeover.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of all volume shadow copies via vssadmin with the quiet flag. This behavior matches BlackSuit ransomware operated by Ignoble Scorpius which removes shadow copies to inhibit system recovery before encryption. Shadow copy deletion is a strong pre-encryption indicator and warrants immediate response to prevent irreversible data loss.

Malicious FrostyGoop OT Encryptor Execution with Modbus Config

This rule detects execution of the FrostyGoop OT malware binary go-encrypt.exe or any process referencing its task_test.json Modbus configuration file. This behavior matches the FrostyGoop campaign targeting industrial control systems where the tool read a JSON target list to issue unauthorized Modbus commands. Detecting the encryptor and its config is critical because it directly manipulates OT device registers and can disrupt physical processes.

Malicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell using Add-MpPreference to register a Microsoft Defender path exclusion, a defense-evasion step the Silent Skimmer actor performed to protect payload directories from scanning. Excluding attacker-controlled folders lets malware run and persist without antivirus detection.

Suspicious LSASS Credential Access via PowerShell (via process_creation)

This rule detects PowerShell command lines referencing lsass, the mechanism the extortion actor used to dump credentials from the Local Security Authority Subsystem Service memory. Reading or dumping LSASS through PowerShell exposes plaintext credentials and hashes for lateral movement.

Malicious Inhibit System Recovery via Shadow Copy and Boot Config Tampering (via process_creation)

This rule detects deletion of Volume Shadow Copies via vssadmin or wmic and disabling of Windows recovery via bcdedit, the recovery-inhibition sequence Repellent Scorpius runs before deploying Cicada3301 ransomware. Destroying backups and recovery options maximizes encryption impact and pressures victims to pay.

Malicious zqtxmo Batch Script Execution by Fighting Ursa

This rule detects execution of the zqtxmo.bat batch script run by Fighting Ursa after a sideloaded DLL entry point, a stage that launches msedge with a base64 argument to reach its webhook based command and control. The named batch file is a distinctive artifact of this infection chain. Detecting it exposes the follow-on execution stage of the campaign.

Suspicious Double Extension Image Executable by Fighting Ursa

This rule detects execution of a file using a deceptive image double extension ending in jpg.exe, the disguise Fighting Ursa applies to a renamed calc.exe delivered in its car-for-sale phishing lure. The double extension tricks users into launching a program that appears to be a photo. Detecting this exposes user execution of the masqueraded first-stage binary.

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Suspicious Docker Socket Access via curl Unix Socket for Container Escape

This rule detects curl talking to the Docker daemon over its Unix socket to create or start containers, a technique used to escape a container by spawning a privileged sibling with the host filesystem mounted. Direct access to docker.sock grants effective root on the node. Detecting this exposes an attempted breakout through the exposed Docker API.