Sigma detection rules, expert-reviewed

Malicious WSH Script Execution from WebDAV Share (via process_creation)

This rule detects wscript.exe or cscript.exe executing a script hosted on a remote WebDAV share as shown by the DavWWWRoot path token, a delivery method abused through malicious URL and LNK files pointing at Cloudflare tunnel WebDAV servers. Script execution directly from a WebDAV UNC path is rarely legitimate.

Malicious DLL Sideloading via LOLBins from ProgramData by Dohdoor

This rule detects trusted Windows utilities loading propsys or batmeter DLLs from ProgramData or the Public directory. The Dohdoor campaign sideloads its payload through living-off-the-land binaries such as OpenWith and mblctr running from unusual paths. A signed utility loading a system-named DLL from a writable directory is a strong sideloading indicator.

Suspicious Playit.gg Tunnel Domain Resolution Used by XenoRAT (via dns_query)

This rule detects DNS resolution of playit.gg tunnel subdomains under the gl.at.ply.gg pattern used as XenoRAT command-and-control endpoints distributed through .gg domains and GitHub. Adversaries leverage the free playit.gg tunneling service to expose their RAT controller while hiding the true C2 host.

Suspicious Browser History Clearing via RunDll32 InetCpl ClearMyTracksByProcess (via process_creation)

This rule detects rundll32.exe invoking InetCpl.cpl ClearMyTracksByProcess to wipe browsing history and cached traces, an indicator-removal behavior used by the CylindricalCanine GoldenEyeDog subgroup during the DigiCert-linked intrusion. Adversaries clear these tracks to hinder investigation after credential and screenshot collection, making detection useful for surfacing anti-forensic activity on a compromised host.

Suspicious ClickFix Command Staged in RunMRU Registry Key

This rule detects an mshta, PowerShell, or HTTP-bearing command written into the Explorer RunMRU registry key, the artifact left when a user pastes a ClickFix lure into the Windows Run dialog. RunMRU records commands executed through Run, exposing the social engineering payload. Interpreter or URL strings in RunMRU are a reliable indicator of ClickFix execution.

Masquerading Certificate Issuance with Certighost cdc and rmd Request Attributes (via security)

This rule detects certificate issuance events carrying the cdc or rmd request attributes used by the Certighost CVE-2026-54121 exploit to steer a Certificate Authority toward an attacker-chosen client Domain Controller. Adversaries leverage these attributes to obtain a certificate that authenticates as a Domain Controller machine account, making early detection critical for exposing certificate-based DC impersonation before DCSync.

Suspicious DNS-over-HTTPS C2 via Wildcard DNS Services

This rule detects DNS resolution of sslip.io and nip.io wildcard DNS domains that encode an IP address in the hostname, matching BRICKSTORM DNS-over-HTTPS command-and-control on appliances and hypervisors. Espionage operators use these services to dynamically map beacon traffic to attacker infrastructure while blending with legitimate DNS.

Suspicious AWS SSO Token Creation and Role Credential Retrieval (via cloudtrail)

This rule detects the AWS SSO CreateToken and GetRoleCredentials calls against sso.amazonaws.com, the API sequence Red Canary described adversaries using to replay cached SSO tokens stolen from the .aws sso cache. When these calls originate from multiple IP addresses in a short window they indicate an actor exchanging a stolen access token for STS role credentials.

Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)

This rule detects the GootBot implant using the PowerShell Start-Job cmdlet to run base64-decoded payloads in background jobs, evading child-process monitoring. The pairing of Start-Job with a FromBase64String call inside a scriptblock is a strong indicator of in-memory loader activity. Routine administrative scripts seldom combine these.

Suspicious Hidden Directory configrc for Bandwidth SDK Abuse

This rule detects references to the hidden .configrc directory used to stage tooling. In the campaign monetizing victim bandwidth via proxyware SDKs the attackers hide stager scripts z593 z401 and z402 inside a .configrc directory. Use of this hidden directory helps conceal the proxyware installation footprint.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry (UAT-7237)

This rule detects setting the LocalAccountTokenFilterPolicy registry value to 1, which disables remote UAC filtering and grants full administrative tokens to local accounts over the network. The UAT-7237 group enables this to facilitate lateral movement with local administrator credentials. This change weakens a key remote-access security control.

Suspicious Registry Run Key Modification For Persistence

This rule detects new or modified values under the Windows Run and RunOnce autostart keys observed through registry set telemetry. In the WithSecure Code Execution and Persistence Lab 2 payload paths are written to these keys to launch at logon. Attackers use autostart registry persistence to maintain access across reboots.

Malicious Ransomware Ransom Note README-RECOVER File Creation

This rule detects creation of README-RECOVER ransom note text files, the note naming convention dropped during the Qilin ransomware encryption stage. These notes appear across directories once mass file encryption completes. Their creation is a definitive indicator that ransomware impact has already occurred and requires immediate response.

Suspicious Mail Send via Microsoft Graph by Application Identity via M365 Audit

This rule detects mail sent through the Microsoft Graph sendMail action by an application or agent identity, the delivery step an attacker uses after hijacking an Entra assistive agent to send internal spearphishing. Because agents that gain send-mail access can distribute malicious links from a trusted internal identity, Graph-driven mail sends attributed to service principals should be reviewed against recent consent grants.

Possible Origin Logger C2 Exfiltration via Hardcoded User Agent and Gate Endpoints via proxy

This rule detects Origin Logger keylogger command and control traffic that beacons with a hardcoded Firefox/99.0 user agent to /gate and /login exfiltration endpoints. Origin Logger is an AgentTesla derived stealer that harvests browser credentials and web session data. Correlating the fixed user agent with the exfil URI paths surfaces credential theft egress while suppressing benign Firefox browsing.