Sigma detection rules, expert-reviewed

Malicious BadIIS SEO Poisoning C2 Request via Web Server (via webserver)

This rule detects HTTP requests to the hardcoded BadIIS command-and-control endpoint used by the Operation Rewrite SEO poisoning campaign. The BadIIS native IIS module intercepts requests and communicates with attacker infrastructure through this fixed URI path. Detecting these requests exposes a compromised IIS server acting as a malicious proxy for SEO fraud and traffic redirection.

Suspicious Python Execution Spawned from Batch and Script Chain

This rule detects python.exe launched by a command interpreter that was itself started from a batch or PowerShell parent, matching the BAT to PowerShell to CMD to python execution tree of the Snake Python infostealer. Attackers use this chained launcher to unpack and run the Python stealer while blending into scripted activity. The interpreter-to-python lineage highlights the malware execution flow.

Malicious PHP Webshell Dropped in PAN-OS Unauthenticated Web Root

This rule detects a PHP file being written under the PAN-OS management web root path /var/appweb/htdocs/unauth/ which Wiz observed attackers using to drop webshells while exploiting CVE-2024-0012 and CVE-2024-9474 in the wild. This is important because the unauth directory should never contain attacker PHP scripts so a new PHP file there is a high confidence indicator of authentication bypass followed by webshell installation on the firewall.

Malicious RDP Shadow Session Started - Command (via process_creation)

This rule detects would attempt to shadow a RDP session.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

This rule detects execution of the SharpGPOAbuse tool renamed to gpo.exe from the C:\Users\Public directory during a CrazyHunter ransomware intrusion. The attacker abuses Group Policy to push ransomware components domain-wide, so an unsigned GPO manipulation binary launched from a world-writable path signals defense evasion and preparation for mass deployment.

Malicious Event Log Clearing via Wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensics action used to erase traces of intrusion activity. This was observed during KawaLocker ransomware deployment alongside firewall and shadow copy tampering. Wiping logs removes the primary evidence responders use to trace attacker actions.

Suspicious DNS Tunneling With Hex Subdomain To info Domain (via dns_query)

This rule detects DNS queries to info domains whose leftmost label is a long hexadecimal string, the encoding CoinLoader uses to tunnel data and receive commands over DNS TXT records. High-entropy hex subdomains under a single parent domain are a strong signal of DNS tunneling rather than normal name resolution.

Malicious Azure Storage and Compute Destruction via Key Listing and Snapshot Deletion

This rule detects Azure operations that list storage account keys and delete storage or compute snapshots. Microsoft observed Storm-0501 combining these to exfiltrate then destroy cloud data and backups for extortion. Bulk key retrieval followed by resource and snapshot deletion is destructive impact activity, so these operations should be treated as a possible cloud ransomware event.

Suspicious MSBuild LOLBin Spawning Script Interpreter (via process_creation)

This rule detects MSBuild.exe spawning PowerShell or cmd child processes which indicates inline task code execution abused as a signed binary proxy. Legitimate build automation rarely has MSBuild directly launching interactive script interpreters.

Suspicious Regsvr32 Execution Of DLL From User Writable Path via Process Creation

This rule detects regsvr32.exe registering a DLL located in a user-writable directory such as Temp or AppData. Emotet drops its payload DLL into a temporary folder and executes it through regsvr32 to proxy execution and evade application controls, a pattern uncommon for legitimate software.

Suspicious SMB MaxMpxCt Registry Tuning (via registry_set)

This rule detects modification of the LanmanServer MaxMpxCt registry value, which Repellent Scorpius raises to increase the number of concurrent SMB commands and accelerate lateral movement and ransomware distribution. Tuning this value is uncommon outside of specialized administration and often precedes mass network encryption.

Malicious PowerShell Download Rename and Execute Chain via Script Block

This rule detects a PowerShell script block that downloads a file into the public directory with Invoke-WebRequest, renames it to an executable with Rename-Item, and launches it with Start-Process. RomCom uses this exact chain after its Firefox and Windows zero-day exploitation to stage and run its backdoor. This indicates scripted payload delivery following exploitation.

Malicious Privileged Container Launch With Host Root Mount via Docker

This rule detects a docker run command that starts a privileged container while bind mounting the host root filesystem which threat actors abusing exposed Docker and Kubernetes APIs use to escape the container and gain full control of the underlying node for cryptomining.

Suspicious conhost Headless Execution for Hidden Window

This rule detects conhost launched with the --headless flag which suppresses the console window, a defense evasion technique seen in ACR Stealer intrusion chains. Hiding the console window conceals attacker command execution from the user during infostealer activity.