Sigma detection rules, expert-reviewed

Malicious Interactive Privileged Shell Triggered by Schedule Task - Deprecated (via process_creation)

This rule detects abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.

AppleScript do-shell-script Abuse via Osascript (via process_creation)

This rule detects osascript running an AppleScript do-shell-script clause that also invokes curl, base64, python or a shell in temp, a pattern macOS malware and post-exploitation tooling use to stage and run second-stage code. AppleScript-driven shell execution is a scripting-abuse technique noted in the Red Canary Threat Detection Report macOS coverage. Detecting this combination surfaces script-based execution on macOS endpoints.

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

This rule detects enumerate potential existing users, resulting in failed logins with unexisting or invalid accounts.

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Any Protocol (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Webserver IIS Configuration Edited - SYSMON (via file_event)

This rule detects edit IIS configuration file in order to load a module.

Malicious SQL Server Lateral Movement with CLR Activation (via application)

This rule detects enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.

Untrusted Disabling of macOS Gatekeeper via Spctl (via process_creation)

This rule detects spctl --master-disable, which turns off Gatekeeper so unsigned and unnotarized applications can run without warning, a defense-evasion step preceding malware execution on macOS. Disabling Gatekeeper is a technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces an attacker removing code-signing enforcement.

Suspicious Shell Profile Persistence Modification (via process_creation)

This rule detects commands that append to shell startup files such as .bashrc, .bash_profile, .zshrc or /etc/profile.d, which run automatically at each login and are abused for durable execution on Linux. Shell-profile persistence is a technique tracked in the Red Canary Threat Detection Report. Detecting the modification surfaces a login-triggered foothold.

Suspicious Shell History Clearing or Disabling (via process_creation)

This rule detects commands that clear or disable shell history, such as truncating bash_history, unsetting HISTFILE or setting HISTFILESIZE to zero, an anti-forensic step used to hide interactive activity on a Linux host. Shell history tampering is an indicator-removal technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces an operator covering hands-on-keyboard tracks.

Suspicious SSH authorized_keys Persistence Modification (via process_creation)

This rule detects command lines that append to or fetch content into an SSH authorized_keys file, which plants an attacker public key for durable, credential-free remote access to a Linux host. Adding rogue SSH keys is an account-manipulation persistence technique tracked in the Red Canary Threat Detection Report. Detecting the modification surfaces a persistence foothold being established.

USN Change Journal Deletion via Fsutil (via process_creation)

This rule detects fsutil deleting the NTFS USN change journal, an indicator-removal technique that erases the record of file creations and modifications to frustrate forensic timeline reconstruction. USN journal deletion is tracked in the Red Canary Threat Detection Report. Detecting this command surfaces anti-forensic activity on the host.

Malicious SQL Server Auditing Deactivated (via application)

This rule detects deactivates SQL Server auditing capacities. SQL auditing requires previous configuration on each SQL instance.

Obfuscated Massive Service Failures - Tchopper (via system)

This rule detects uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

This rule detects wuauclt.exe invoked with UpdateDeploymentProvider and RunHandlerComServer arguments, which loads an attacker DLL through the Windows Update client, a signed-binary proxy technique. Wuauclt abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces trusted-binary DLL loading.

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

This rule detects PowerShell setting both CreationTime and LastWriteTime on a file, the hallmark of timestomping used to blend a dropped payload in with legitimate files and defeat timeline analysis. Timestomping is an indicator-removal technique tracked in the Red Canary Threat Detection Report. Detecting these property assignments surfaces anti-forensic tampering with file metadata.