Sigma detection rules, expert-reviewed

Suspicious Domain Controller Discovery via nltest

This rule detects use of nltest to enumerate domain controllers and domain trust relationships, a reconnaissance step observed during CitrixBleed (CVE-2023-4966) post-exploitation. Attackers run this after gaining a foothold to map the Active Directory environment before lateral movement. Detecting the enumeration provides an early signal of hands-on-keyboard activity.

Malicious Octo Tempest Federation Persistence via AADInternals (via ps_script)

This rule detects use of the AADInternals PowerShell toolkit through its characteristic cmdlets. Octo Tempest leveraged AADInternals to forge Golden SAML tokens and manipulate Entra ID federation trust for persistent tenant access.

Malicious Matanbuchus Persistence via regsvr32 Silent Install with User Context (via process_creation)

This rule detects execution of regsvr32 with the no-register and user-context install flags to invoke a DLL entry point, the persistence and execution behavior run every five minutes by the Matanbuchus 3.0 EventLogBackupTask scheduled task. Adversaries leverage regsvr32 as a signed LOLBin to load a malicious DLL through its DllInstall path while bypassing DllRegisterServer monitoring, making early detection critical for surfacing loader persistence before payload deployment.

Suspicious Offensive Recon and Credential Tools Execution (via process_creation)

This rule detects execution of the fscan network scanner and the SharpDecryptPwd credential extraction utility. The SLOW#TEMPEST campaign used these tools for internal reconnaissance and browser credential theft.

Suspicious RegAsm Launched by Script Host (via process_creation)

This rule detects the .NET RegAsm utility being launched by a script host or Equation Editor. This steganography campaign injects Remcos, AgentTesla, and LimeRAT into RegAsm through process hollowing.

Suspicious Curl Download to Windows Temp via PowerShell (via process_creation)

This rule detects PowerShell invoking curl with follow-redirect to download a payload into the Windows Temp directory, a staging step in the SILENTCONNECT campaign delivering ScreenConnect. Observed in Elastic Security Labs telemetry where an execution-policy-bypassed PowerShell retrieves the next-stage installer for remote access.

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

This rule detects a Python interpreter reading another process memory through /proc maps and mem, the technique the compromised tj-actions/changed-files GitHub Action used to dump CI runner memory. It is important because this behavior harvests secrets and tokens from the runner and leaks them into build logs.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Malicious System Recovery Inhibition via bcdedit Boot Configuration Changes (via process_creation)

This rule detects bcdedit disabling Windows recovery by setting recoveryenabled to No or bootstatuspolicy to ignoreallfailures, a recovery-inhibition behavior used by the Hunters International ransomware group per Group-IB. Adversaries alter the boot configuration to block automatic repair before encryption, making this a reliable pre-impact signal.

Suspicious COOKIE SPIDER macOS Data Exfiltration via curl Archive Upload (via process_creation)

This rule detects curl uploading an archive named out.zip on macOS. The SHAMOS stealer delivered by COOKIE SPIDER collects credentials and wallet files and exfiltrates them in an out.zip archive via curl. A curl invocation referencing this archive name is a high-fidelity exfiltration indicator.

Linux: Detect modprobe-based authencesn crypto module auto-load via kmod

Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".

BURNBOOK DLL Sideloading via SumatraPDF.exe Loading libmupdf.dll from User Directory (via image_load)

This rule detects SumatraPDF.exe loading a libmupdf.dll from a user-writable directory such as Downloads or Temp, the DLL side-loading behavior used to launch the BURNBOOK loader delivered in a ZIP archive during Operation DreamJob intrusions. Adversaries pair a benign PDF reader with a malicious library to execute their loader under a trusted process.

Suspicious Cmd Using Curl to Download and Execute Payload (via process_creation)

This rule detects a cmd.exe command line that sets a small console mode, downloads a file with curl, and immediately starts it. This pattern matches loaders built with the MisterioLNK open-source builder.

Suspicious AWS STS Role Chaining From Temporary Session Credentials (via cloudtrail)

This rule detects an AWS STS AssumeRole call whose caller is already an assumed-role session, the role chaining pattern attackers use to mint successive ASIA temporary credentials and persist beyond a single session expiry. Chained AssumeRole invocations extend stolen access and evade credential lifetime controls. Detecting assumed-role principals assuming further roles surfaces this persistence technique.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.