Sigma detection rules, expert-reviewed

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Suspicious Docker Socket Access via curl Unix Socket for Container Escape

This rule detects curl talking to the Docker daemon over its Unix socket to create or start containers, a technique used to escape a container by spawning a privileged sibling with the host filesystem mounted. Direct access to docker.sock grants effective root on the node. Detecting this exposes an attempted breakout through the exposed Docker API.

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell wscript or cscript, the initial execution DarkGate triggers when a lure workbook launches an embedded object to pull remote scripts over SMB. Office applications launching script hosts is a strong indicator of malicious document activity. Detecting this parent-child relationship exposes the DarkGate delivery stage.

Malicious certutil Decodehex Payload Reconstruction by DarkGate

This rule detects certutil being run with the decodehex option to reconstruct a binary from a downloaded hex-encoded file, a step DarkGate uses to rebuild an AutoHotkey interpreter from a dropped a.bin file. Abusing certutil for decoding is a living-off-the-land technique that evades signature-based download controls. Detecting this exposes payload deobfuscation during the DarkGate infection chain.

Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400

This rule detects the PAN-OS running configuration being copied or staged into a web-accessible file carrying a .css extension, a behavior observed in Operation MidnightEclipse exploiting CVE-2024-3400. Attackers rename running-config.xml to a stylesheet so the device configuration can be retrieved over the management web interface. Detecting this exposes hands-on-keyboard post-exploitation and configuration theft on the firewall.

Malicious Linux Payload Download and Execution Chain via Wget and Chmod (via process_creation)

This rule detects a shell command chain that fetches a binary with wget into tmp, grants it full execute permissions with chmod 777, and prepares it to run, the classic exploitation payload staging seen in the botnet scanning campaigns abusing Zyxel and Ivanti flaws. This download and execute sequence over a single command line reflects automated post exploitation rather than legitimate package management.

Suspicious EACoreServer Masquerading as WindowsUpdate Executable (via process_creation)

This rule detects a process launched as WindowsUpdate.exe whose original file name is EACoreServer.exe, the renaming trick a Chinese APT used to disguise a legitimate signed binary as a Windows update component for sideloading. The mismatch between the on disk name and the embedded original name exposes the masquerade, distinguishing it from genuine update processes.

Suspicious StrelaStealer DLL Execution via Rundll32 Hello Export from Temp (via process_creation)

This rule detects rundll32.exe invoking the hello export of a DLL located in an AppData or temp directory, the loader behavior StrelaStealer uses to run its stealer payload dropped by a JScript file. The combination of a proxy execution binary, a user writable path, and the campaign specific export name reflects the StrelaStealer execution stage rather than normal library invocation.

Suspicious Csrss Process Masquerading Outside System32 (via process_creation)

This rule detects a process named csrss.exe running from any location other than the System32 or SysWOW64 directories, a masquerade used by the Glupteba packed installer to blend with the legitimate Client Server Runtime Subsystem. The genuine csrss.exe only ever launches from System32, so an off path copy indicates a spoofed loader attempting to hide malicious execution.

Malicious Mispadu Payload Execution from WebDAV Share via Rundll32 (via process_creation)

This rule detects rundll32.exe executing a DLL from a remote WebDAV share referenced through a file URL, a delivery technique used by the Mispadu infostealer to bypass SmartScreen and run its payload. Mispadu is a Latin American banking trojan that harvests browser credentials, and this remote execution path lets it evade reputation-based controls during initial access.

Malicious Scheduled rundll32 Execution of ProgramData VMware DLL by BianLian

This rule detects rundll32.exe executing a DLL from a ProgramData VMware directory with an Entry export and redirecting output to a temp file, matching the persistence and execution behavior of the BianLian ransomware group per Unit 42. The actor masquerades its loader as a VMware component and runs it via a scheduled task which evades scrutiny and maintains access.

Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens

This rule detects service or driver loading of the renamed vulnerable GMER driver AGMT.sys or the rentdrv2 driver used by Agonizing Serpens (Agrius) to disable endpoint security through a bring-your-own-vulnerable-driver technique. The actor abuses signed but exploitable drivers to terminate EDR processes by PID which blinds defenses ahead of wiper deployment.

Malicious BlackCat Munchkin Controller Execution via process_creation

This rule detects the BlackCat Munchkin utility boot sequence that runs the /app/controller binary and then powers off the disposable Linux virtual machine. Munchkin executes its ransomware controller from this hardcoded path inside a throwaway VM to evade host defenses, so this command shape is a high-confidence indicator of Munchkin execution.

Malicious Turla Kopiluwak Reconnaissance Output to Windows Temp via process_creation

This rule detects command execution that writes reconnaissance output to the result2.dat file under the Windows Temp directory. Turla (Pensive Ursa) Kopiluwak dropper stages the results of systeminfo, tasklist, net, ipconfig and dir enumeration into this hardcoded artifact, so this combination reveals staged host discovery ahead of follow-on tasking.

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

This rule detects GlobalProtect gateway connections carrying the hard-coded device names and placeholder MAC addresses embedded in public proof-of-concept code for PAN-OS CVE-2026-0257. Presence of these exploit-specific constants indicates an attempt to abuse the flaw for unauthenticated access.