Sigma detection rules, expert-reviewed

Linux: Detect modprobe-based authencesn crypto module auto-load via kmod

Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".

BURNBOOK DLL Sideloading via SumatraPDF.exe Loading libmupdf.dll from User Directory (via image_load)

This rule detects SumatraPDF.exe loading a libmupdf.dll from a user-writable directory such as Downloads or Temp, the DLL side-loading behavior used to launch the BURNBOOK loader delivered in a ZIP archive during Operation DreamJob intrusions. Adversaries pair a benign PDF reader with a malicious library to execute their loader under a trusted process.

Suspicious Cmd Using Curl to Download and Execute Payload (via process_creation)

This rule detects a cmd.exe command line that sets a small console mode, downloads a file with curl, and immediately starts it. This pattern matches loaders built with the MisterioLNK open-source builder.

Suspicious AWS STS Role Chaining From Temporary Session Credentials (via cloudtrail)

This rule detects an AWS STS AssumeRole call whose caller is already an assumed-role session, the role chaining pattern attackers use to mint successive ASIA temporary credentials and persist beyond a single session expiry. Chained AssumeRole invocations extend stolen access and evade credential lifetime controls. Detecting assumed-role principals assuming further roles surfaces this persistence technique.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.

Suspicious Metabase Setup Token Disclosure via Session Properties Endpoint (CVE-2023-38646) (via webserver)

This rule detects requests to the unauthenticated Metabase session properties endpoint that leaks the setup token. This maps to the reconnaissance stage of CVE-2023-38646 where the token is harvested to enable the H2 JDBC injection. Repeated or external access to this endpoint may indicate an attacker preparing pre-auth code execution.

Malicious NTDS.dit Access via esentutl Database Copy (via process_creation)

This rule detects esentutl.exe operating on the ntds.dit Active Directory database file, an operation used during this intrusion to copy or process the domain credential store extracted from a volume shadow copy. Adversaries leverage the esentutl LOLBin to handle the locked database and recover hashes, making detection of ntds.dit in its command line a strong credential-access signal.

Malicious Empyrean Stealer Run Key Persistence (via registry_set)

This rule detects creation of an autostart Run key named empyrean which the Empyrean information stealer uses to persist on the host. The stealer harvests browser credentials and Discord tokens and re-executes at every user logon through this value.

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious ADNotificationManager Execution for netutils.dll Side-Loading (via process_creation)

This rule detects the Adobe ADNotificationManager.exe binary running from a user writable directory rather than its installed Adobe program path, where the RedCurl EarthKapre APT side-loads a malicious netutils.dll. Relocating the signed executable lets the attacker force loading of an attacker controlled library beside it. Execution of this Adobe component from a temporary or profile path is a strong side-loading indicator.

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

This rule detects call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

This rule detects the creation of Python site-initialization hooks sitecustomize.py and usercustomize.py or a .pth file inside site-packages, the persistence mechanism used by the malicious Python packages reported by Cisco Talos. These files execute automatically every time the interpreter starts, giving attackers durable code execution. Detecting writes of these hooks reveals stealthy persistence planted through the packaging ecosystem.

Suspicious Windows Event Log Cleared during StilachiRAT Anti-Forensics (via security)

This rule detects the clearing of the Windows Security event log, an anti-forensic action performed by StilachiRAT which monitors event IDs and wipes logs to erase traces of its reconnaissance and cryptocurrency-theft activity. Adversaries clear logs to frustrate incident response after credential and wallet theft, so a 1102 log-clear event outside sanctioned maintenance is a strong tampering indicator.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Malicious Scheduled Task Named CorelDefrag Under Windows Defrag Path

This rule detects the creation of a scheduled task named CorelDefrag placed inside the legitimate Windows Defrag task folder. The eScan supply chain attack persisted its implant with a task under Microsoft Windows Defrag CorelDefrag as reported by Kaspersky. Placing a rogue task inside a trusted system task path indicates masquerading persistence.