Sigma detection rules, expert-reviewed

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious SAM and SYSTEM Hive Dump via reg save

This rule detects reg.exe saving the SAM or SYSTEM registry hives to disk which the Librarian Ghouls APT exports to a staging folder to harvest local credentials offline. Dumping these hives enables offline password and secret extraction after gaining local admin. Reg save of security hives is rarely part of legitimate administration.

Malicious Service Creation for DcRAT Persistence via sc.exe (via process_creation)

This rule detects use of sc.exe to create the MixedSvc service pointing at a masqueraded Mixed Reality.exe binary under the Windows Media Player folder, the persistence mechanism used by Operation DragonReturn to survive reboots. The actor abused Windows service control to auto-start its DcRAT loader with SYSTEM privileges, making this a high-value chokepoint for catching the intrusion before code injection into svchost.

Suspicious Clearing of hosts.deny Access Restrictions on Linux

This rule detects shell activity that clears or overwrites the etc hosts.deny file. Automated SSH intrusion actors wipe host based access controls immediately after login to guarantee continued reachability before injecting their own authorized keys.

Malicious Eldorado Ransomware Ransom Note Creation

This rule detects the creation of the HOW_RETURN_YOUR_DATA.TXT ransom note dropped by Eldorado ransomware across encrypted directories. The note appears once encryption completes and delivers the extortion demand. It matters because its widespread creation confirms an active Eldorado impact event on the host or shares.

Malicious MoustachedBouncer Service DLL Hijack of WmdmPmSp via Registry (via registry_set)

This rule detects modification of the legitimate WmdmPmSp service ServiceDll value to point at the malicious creh.dll, a persistence method used by the MoustachedBouncer toolset. Hijacking an existing service DLL lets the implant run inside a trusted svchost process and survive reboots.

Malicious Defender Real-Time Monitoring Disabled by The Gentlemen RaaS (via process_creation)

This rule detects Set-MpPreference invoked to disable Microsoft Defender real-time monitoring, a defense-evasion step used by The Gentlemen ransomware operators before deploying tooling. Turning off real-time protection lets subsequent payloads run unimpeded. Catching this reveals active tampering with endpoint defenses.

Possible Sitecore Path Traversal via ValidateXHtml PAGESTATE Injection

This rule detects requests to the Sitecore EditHtml.ValidateXHtml handler carrying a __PAGESTATE parameter with directory traversal sequences, matching the order-of-operations bug that Assetnote leveraged to reach RCE in Sitecore 8.x to 10.x. The traversal in the page-state value leaks server paths and enables the subsequent exploitation chain. Early detection of this handler abuse exposes reconnaissance before code execution.

Malicious Container Escape via core_pattern Hijack (via process_creation)

This rule detects a process writing to the kernel core_pattern handler under proc sys kernel, a technique used in the BrokenSesame research to break out of a container by having a crash trigger execution on the host. Attackers set core_pattern to a pipe handler and then force a segfault to run code with host privileges. Modification of this kernel path from a workload is a strong escape signal.

Malicious BadIIS SEO Poisoning C2 Request via Web Server (via webserver)

This rule detects HTTP requests to the hardcoded BadIIS command-and-control endpoint used by the Operation Rewrite SEO poisoning campaign. The BadIIS native IIS module intercepts requests and communicates with attacker infrastructure through this fixed URI path. Detecting these requests exposes a compromised IIS server acting as a malicious proxy for SEO fraud and traffic redirection.

Suspicious Python Execution Spawned from Batch and Script Chain

This rule detects python.exe launched by a command interpreter that was itself started from a batch or PowerShell parent, matching the BAT to PowerShell to CMD to python execution tree of the Snake Python infostealer. Attackers use this chained launcher to unpack and run the Python stealer while blending into scripted activity. The interpreter-to-python lineage highlights the malware execution flow.

Malicious PHP Webshell Dropped in PAN-OS Unauthenticated Web Root

This rule detects a PHP file being written under the PAN-OS management web root path /var/appweb/htdocs/unauth/ which Wiz observed attackers using to drop webshells while exploiting CVE-2024-0012 and CVE-2024-9474 in the wild. This is important because the unauth directory should never contain attacker PHP scripts so a new PHP file there is a high confidence indicator of authentication bypass followed by webshell installation on the firewall.

Malicious RDP Shadow Session Started - Command (via process_creation)

This rule detects would attempt to shadow a RDP session.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

This rule detects execution of the SharpGPOAbuse tool renamed to gpo.exe from the C:\Users\Public directory during a CrazyHunter ransomware intrusion. The attacker abuses Group Policy to push ransomware components domain-wide, so an unsigned GPO manipulation binary launched from a world-writable path signals defense evasion and preparation for mass deployment.