Sigma detection rules, expert-reviewed

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

This rule detects AWS Organizations and account enumeration API calls that map the blast radius of compromised access keys. Unit 42 observed this cloud service discovery during the SugarCRM incident where stolen credentials were used to survey the target environment before resource abuse, so alerting is warranted when these calls come from unexpected principals.

Suspicious Security Software Discovery via tasklist and findstr (via process_creation)

This rule detects tasklist output piped into findstr to search for antivirus process names such as Bitdefender, ESET, Quick Heal and Sophos. The Lumma infostealer enumerates running security products this way to fingerprint defenses and adjust its behavior before credential theft.

Uncommon Domain Trust Discovery via Nltest (via process_creation)

This rule detects nltest.exe being used to enumerate domain controllers and domain trust relationships, a discovery step that adversaries and loaders such as those profiled in the Red Canary Threat Detection Report run to understand the Active Directory environment before moving laterally. Because interactive nltest trust enumeration is uncommon on typical endpoints, it is a useful early indicator of hands-on-keyboard reconnaissance. Detecting these queries surfaces the adversary orienting inside the domain.

Suspicious Active Directory Discovery via ADFind

This rule detects execution of the ADFind reconnaissance utility which Black Basta operators use to enumerate Active Directory users groups and computers during the discovery phase of an intrusion. While ADFind is a legitimate administrative tool its presence on endpoints is frequently associated with pre ransomware reconnaissance.

Suspicious Credential File Discovery via Find on Linux

This rule detects use of the find utility to recursively search common home and system directories for environment key and credential files which React2Shell CVE-2025-55182 post-exploitation scripts use to locate AWS SSH and application secrets for theft. Broad filesystem searches targeting env and key extensions indicate automated credential discovery on a compromised host.

Suspicious KeePass Configuration Discovery via PowerShell Script

This rule detects execution of the Find-KeePassConfig PowerShell function, used by the ransomware actor Storm-0501 to locate KeePass password database configuration files for credential theft. Discovering KeePass configs is a precursor to extracting master keys and stored secrets from password vaults.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating trusted domains, an Active Directory discovery step used to map trust relationships for lateral movement. This was observed after SonicWall VPN exploitation preceding Akira ransomware. Domain trust enumeration from user context or servers often marks hands-on-keyboard reconnaissance.

Possible System and File Discovery via System_profiler or Mdfind (via process_creation)

This rule detects system_profiler or mdfind enumerating host details and indexed files, a system-information and file-discovery step attackers use to profile a macOS endpoint after initial access. Host discovery is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting these queries surfaces reconnaissance of the system.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Suspicious Domain Controller Discovery via nltest

This rule detects use of nltest to enumerate domain controllers and domain trust relationships, a reconnaissance step observed during CitrixBleed (CVE-2023-4966) post-exploitation. Attackers run this after gaining a foothold to map the Active Directory environment before lateral movement. Detecting the enumeration provides an early signal of hands-on-keyboard activity.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

This rule detects the SimpleHelp Remote Access client spawning a command shell that runs account and domain enumeration utilities. Following exploitation of SimpleHelp RMM for initial access, operators used the persisted client to run net and nltest reconnaissance.

Suspicious Domain Trust Discovery via Nltest

This rule detects the nltest utility enumerating domain trusts, a reconnaissance step performed after GoldMelody gained code execution through ASP.NET ViewState deserialization. Adversaries map domain trust relationships to plan lateral movement. While administrators occasionally use nltest, its execution from web-facing hosts is suspicious.

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.