Sigma detection rules, expert-reviewed

Suspicious Metabase Setup Token Disclosure via Session Properties Endpoint (CVE-2023-38646) (via webserver)

This rule detects requests to the unauthenticated Metabase session properties endpoint that leaks the setup token. This maps to the reconnaissance stage of CVE-2023-38646 where the token is harvested to enable the H2 JDBC injection. Repeated or external access to this endpoint may indicate an attacker preparing pre-auth code execution.

Malicious NTDS.dit Access via esentutl Database Copy (via process_creation)

This rule detects esentutl.exe operating on the ntds.dit Active Directory database file, an operation used during this intrusion to copy or process the domain credential store extracted from a volume shadow copy. Adversaries leverage the esentutl LOLBin to handle the locked database and recover hashes, making detection of ntds.dit in its command line a strong credential-access signal.

Malicious Empyrean Stealer Run Key Persistence (via registry_set)

This rule detects creation of an autostart Run key named empyrean which the Empyrean information stealer uses to persist on the host. The stealer harvests browser credentials and Discord tokens and re-executes at every user logon through this value.

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious ADNotificationManager Execution for netutils.dll Side-Loading (via process_creation)

This rule detects the Adobe ADNotificationManager.exe binary running from a user writable directory rather than its installed Adobe program path, where the RedCurl EarthKapre APT side-loads a malicious netutils.dll. Relocating the signed executable lets the attacker force loading of an attacker controlled library beside it. Execution of this Adobe component from a temporary or profile path is a strong side-loading indicator.

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

This rule detects call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

This rule detects the creation of Python site-initialization hooks sitecustomize.py and usercustomize.py or a .pth file inside site-packages, the persistence mechanism used by the malicious Python packages reported by Cisco Talos. These files execute automatically every time the interpreter starts, giving attackers durable code execution. Detecting writes of these hooks reveals stealthy persistence planted through the packaging ecosystem.

Suspicious Windows Event Log Cleared during StilachiRAT Anti-Forensics (via security)

This rule detects the clearing of the Windows Security event log, an anti-forensic action performed by StilachiRAT which monitors event IDs and wipes logs to erase traces of its reconnaissance and cryptocurrency-theft activity. Adversaries clear logs to frustrate incident response after credential and wallet theft, so a 1102 log-clear event outside sanctioned maintenance is a strong tampering indicator.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Malicious Scheduled Task Named CorelDefrag Under Windows Defrag Path

This rule detects the creation of a scheduled task named CorelDefrag placed inside the legitimate Windows Defrag task folder. The eScan supply chain attack persisted its implant with a task under Microsoft Windows Defrag CorelDefrag as reported by Kaspersky. Placing a rogue task inside a trusted system task path indicates masquerading persistence.

Suspicious Detection of Default a Windows Host Name in Login Attempts (via security)

This rule detects scenarios where a default Windows host name pattern (WIN-...) is detected during a login attempt. Having a host with a default name may be an indicator of a fresh machine deployed by an attacker to evade detection and perform malicious activities.

Suspicious utmpdump Usage for wtmp Log Manipulation

This rule detects the utmpdump utility referencing the wtmp utmp or btmp accounting files. Operators infiltrating global telecom networks use utmpdump to dump edit and reload login records to erase evidence of their sessions. Interactive use of utmpdump against these files is a strong anti-forensics signal.

Malicious Disabling of Carbon Black EDR Service via sc config

This rule detects the sc command reconfiguring the Carbon Black cbdefense service start type to disabled. Sinobi actors disabled the endpoint protection service before deploying ransomware to blind defenders. Disabling a named EDR service through sc config is a deliberate defense-evasion step that precedes encryption and should be treated as a critical event.

Ngrok Tunneling Utility Execution for Command and Control

This rule detects execution of the ngrok tunneling utility, which adversaries use to expose internal services and establish covert command-and-control through a trusted relay. Huntress observed ngrok deployed on compromised servers to tunnel access past perimeter controls. While developers use ngrok legitimately, its presence on servers alongside exploitation activity indicates malicious tunneling.

Malicious JanelaRAT DLL Side-Loading via nevasca.exe (via image_load)

This rule detects the host binary nevasca.exe loading the malicious PixelPaint.dll used by JanelaRAT to hijack execution flow through DLL side-loading. JanelaRAT is a financial remote access trojan targeting users in Latin America. Detecting this loader pair exposes the in-memory execution of the RAT before command-and-control is established.