Sigma detection rules, expert-reviewed

Suspicious Credential Added to Application or Service Principal in Entra ID (via azure)

This rule detects new password or certificate credentials being added to an Entra ID application or service principal, the persistence technique Silk Typhoon uses to abuse OAuth applications and service principals holding administrative permissions. Adversaries append their own secrets to trusted applications to authenticate as the app and access mail, OneDrive, and SharePoint through MSGraph, so unexpected credential additions signal a supply-chain identity compromise.

Malicious Spool Process Spawned a CMD Shell - PrintNightmare Vulnerability - CVE-2021-36958 (via process_creation)

This rule detects exploits the PrintNightmare vulnerability and obtained a CMD shell.

Malicious Outlook Process Memory Dump via procdump

This rule detects procdump creating a full memory dump of the Outlook process, a technique the ToddyCat APT used to extract email data and credentials from memory. The attackers ran procdump64.exe with -ma against OUTLOOK.exe to capture its address space for later mining. Dumping the memory of a mail client is a strong sign of credential and email data theft rather than routine troubleshooting.

Malicious WebDAV Payload Execution via rundll32 davclnt.dll (via process_creation)

This rule detects rundll32.exe invoking DavSetCookie from davclnt.dll, a WebDAV execution technique used by the TimbreStealer campaign to run remote payloads. Executing through the WebDAV client library retrieves and launches code from a remote share under a signed binary.

Suspicious CrazyHunter Distribution Tool Connecting to File Server on Port 9999

This rule detects the CrazyHunter distribution binary file.exe establishing a network connection to a staging file server on TCP port 9999. During the intrusion the operators host payloads on an internal file server and pull them via this tool over the uncommon port 9999, so this traffic indicates lateral staging of ransomware components before encryption.

Malicious ESXi Snapshot Removal Loop Inhibiting Recovery (via process_creation)

This rule detects vim-cmd removing all snapshots across virtual machines, the recovery-inhibition step used by Cicada3301 ransomware on ESXi hosts prior to encryption. Adversaries delete snapshots so encrypted guests cannot be rolled back, making a snapshot removeall operation a strong pre-encryption recovery-tampering signal.

Suspicious OAuth Consent Grant to Mail Access Permissions via Azure AD

This rule detects OAuth application consent grants that request mailbox read/send and offline access scopes in Azure AD audit logs. This aligns with the Huntress traitorware campaign where adversaries consent legitimate mail clients to gain persistent mailbox access, letting them read and send mail via issued tokens without touching the password.

Suspicious BunnyLoader C2 Gate Endpoint Communication (via proxy)

This rule detects HTTP requests to a gate.php endpoint, the command and control resource BunnyLoader polls to register infected hosts and pull tasking on a short heartbeat interval. This gate path is a common malware beacon convention, so requests to it warrant review for loader command and control traffic.

Suspicious PowerShell Download Cradle Using irm and iex via Interlock Loader (via process_creation)

This rule detects the MintLoader stage of Interlock intrusions which runs PowerShell with a hidden window and pipes an Invoke-RestMethod download directly into Invoke-Expression. This irm to iex pattern fetches and executes remote code in memory. It is a common but high signal initial access technique for this actor.

Possible Palo Alto PAN-OS Authentication Bypass via PHP Path Confusion js.map Suffix (via webserver)

This rule detects the path confusion technique in Palo Alto PAN-OS CVE-2024-0012 where a request appends a js.map suffix after a php script to bypass the authentication check on management endpoints. The mixed php and js.map path is not produced by normal clients.

Malicious WDigest UseLogonCredential Enablement For Credential Theft

This rule detects the registry modification that sets WDigest UseLogonCredential to 1, forcing Windows to keep cleartext credentials in LSASS memory. The Qilin ransomware group enables this before dumping credentials to escalate and move laterally. Re-enabling plaintext credential caching is a deliberate precursor to LSASS harvesting.

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

This rule detects a binary named mysql.exe running from a temporary directory with a hardcoded password argument, matching the HarborWatch RAT payload which is renamed to mysql.exe and requires a fixed pass value to execute. Genuine MySQL clients do not run from user temp folders.

Suspicious Domain Controller Discovery via nltest

This rule detects use of nltest to enumerate domain controllers and domain trust relationships, a reconnaissance step observed during CitrixBleed (CVE-2023-4966) post-exploitation. Attackers run this after gaining a foothold to map the Active Directory environment before lateral movement. Detecting the enumeration provides an early signal of hands-on-keyboard activity.

Malicious Octo Tempest Federation Persistence via AADInternals (via ps_script)

This rule detects use of the AADInternals PowerShell toolkit through its characteristic cmdlets. Octo Tempest leveraged AADInternals to forge Golden SAML tokens and manipulate Entra ID federation trust for persistent tenant access.

Malicious Matanbuchus Persistence via regsvr32 Silent Install with User Context (via process_creation)

This rule detects execution of regsvr32 with the no-register and user-context install flags to invoke a DLL entry point, the persistence and execution behavior run every five minutes by the Matanbuchus 3.0 EventLogBackupTask scheduled task. Adversaries leverage regsvr32 as a signed LOLBin to load a malicious DLL through its DllInstall path while bypassing DllRegisterServer monitoring, making early detection critical for surfacing loader persistence before payload deployment.