Sigma detection rules, expert-reviewed

Suspicious Service Principal Name Discovery via setspn Query

This rule detects setspn being used with the query flag to enumerate service principal names, a Kerberoasting preparation step observed during Velociraptor misuse where the actor queried service accounts such as backup SPNs. Enumerating SPNs identifies service accounts whose tickets can be extracted and cracked offline. Command line SPN queries are uncommon outside administrative auditing.

Suspicious Antivirus Product Discovery via WMIC SecurityCenter2 Query

This rule detects use of wmic to query the SecurityCenter2 AntiVirusProduct namespace to enumerate installed security tooling, a reconnaissance step observed in DanaBot to IcedID intrusions. Attackers profile endpoint defenses before dropping later stages so they can select an evasion path.

Suspicious SUID Binary Discovery via Find Perm 4000

This rule detects the find command searching the filesystem for setuid binaries using the perm 4000 predicate which is a common privilege escalation discovery step on Linux hosts. Adversaries enumerate SUID executables to locate misconfigured binaries that can be abused to elevate to root.

Suspicious Meterpreter Host Discovery File Reads on Linux via file_event

This rule detects a process reading the host machine identifier together with the kernel network routing table, a discovery pattern exhibited by Meterpreter payloads on Linux during post-exploitation. This combination is used to fingerprint the host and enumerate network configuration before further action. Access to both of these uncommon paths by the same process is a strong indicator of in-memory implant activity.

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

This rule detects a command line that changes the console code page with chcp and then runs nltest for domain trust enumeration. TA866 Asylum Ambuscade used cmd.exe with chcp 65001 chained to nltest DOMAIN_TRUSTS during host reconnaissance. A UTF-8 code-page switch immediately preceding domain trust enumeration is a scripted discovery pattern tied to this actor.

Suspicious Domain Trust Discovery Via Nltest

This rule detects nltest.exe enumerating domain trust relationships. UAT-5647 ran nltest domain_trusts to map Active Directory trusts during reconnaissance in the RomCom intrusions. Nltest domain trust enumeration is a common domain-discovery action attackers use to plan lateral movement across trusted domains.

Antivirus Software Discovery via tasklist and findstr

This rule detects reconnaissance that pipes tasklist output through findstr to enumerate running security product processes. CastleLoader performs this check to identify installed defenses before deploying its payload.

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

This rule detects quser or qwinsta enumerating interactive logon sessions, a system-owner and remote-session discovery step attackers use to find active administrators before lateral movement. Session discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces reconnaissance of who is logged on.

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

This rule detects command lines that enumerate installed antivirus or EDR products through the SecurityCenter2 WMI namespace or Get-MpComputerStatus, a security-software-discovery step taken to plan defense evasion. Security software discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces an attacker profiling defenses before acting.

Suspicious Group Discovery - Command (via process_creation)

This rule detects enumerate local or domain groups via commandline.

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

This rule detects WMIC queries against keyboard, pointing device and monitor WMI classes used by the SHUYAL stealer to fingerprint the host and detect analysis environments before stealing credentials. Adversaries enumerate attached hardware to build a victim profile and to evade sandboxes that lack real peripherals.

Suspicious Group Discovery - PowerShell (via powershell)

This rule detects enumerate local or domain groups via PowerShell.

Suspicious Discovery Command Spawned by Java Process

This rule detects the Cleo Java runtime spawning Windows discovery utilities such as nltest, whoami, and ipconfig, the hands-on-keyboard reconnaissance seen after exploitation of Cleo file transfer software and the Malichus malware. A Java service process launching domain and host enumeration is not part of normal operation. This lineage indicates active post-exploitation of an internet-facing Cleo server.

Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)

This rule detects PowerShell querying the root/SecurityCenter2 AntivirusProduct WMI class, the security-software discovery step Troll Stealer runs while profiling a victim before credential theft. Adversaries enumerate installed antivirus to tailor evasion, so this query outside of administrative inventory tooling is a meaningful reconnaissance indicator.