Sigma detection rules, expert-reviewed

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

This rule detects the SharePoint IIS worker process w3wp.exe spawning cmd.exe or powershell.exe. Exploitation of the ToolShell SharePoint vulnerabilities results in the web worker launching shells to run base64 encoded commands. A web server process parenting an interactive shell strongly indicates webshell or exploitation activity.

Suspicious SSH Reverse Tunnel Over DNS Port

This rule detects the ssh client establishing a reverse tunnel bound to port 53. Actors compromising telecom providers route SSH reverse tunnels over the DNS port to evade egress filtering. A remote-forward SSH session using port 53 is highly abnormal and indicates covert tunneling.

Suspicious Timestomp via touch Reference Copy

This rule detects the touch command using the -r switch to copy timestamps from a reference file onto another file. Telecom network intruders timestomp their implants with touch -r so dropped files blend with legitimate system files. This behavior obscures the true creation time of attacker artifacts.

Malicious Service Persistence via sc.exe Creating msdnetsvc

This rule detects sc.exe creating a Windows service named msdnetsvc. This service name is used by the backdoor targeting Southeast Asian governments to gain persistence and survive reboots. A named service with this masquerading identity is a high-confidence indicator of the intrusion.

Suspicious extrac32 CAB Extraction Abuse

This rule detects the extrac32 LOLBin extracting cabinet contents using the /Y overwrite and /E extract-all switches. In the observed ClickFix chain extrac32 is abused to unpack a staged payload such as Boat.pst. This living-off-the-land extraction step helps adversaries deploy secondary tooling while avoiding dedicated archive utilities.

Suspicious curl Spawning Script Host for Latrodectus Delivery

This rule detects curl.exe spawning the Windows script host to run JScript or VBScript. The ClickFix to Latrodectus infection chain uses curl to fetch a JavaScript payload which is then executed via cscript. Download utility parenting a script interpreter is highly abnormal on endpoints and marks a malware staging step.

Suspicious PowerShell Execution via Forfiles LOLBIN

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Suspicious Encoded PowerShell Command Execution

This rule detects PowerShell invoked with an encoded-command switch, which conceals the executed script from casual inspection. Malicious LNK files analyzed by Unit 42 launch cmd to run PowerShell with EncodedCommand payloads. Base64-encoded PowerShell is a common obfuscation and execution technique that merits review.

Suspicious Chisel SOCKS Tunnel Command Line

This rule detects command lines invoking the Chisel tunneling tool in client mode with SOCKS proxying. In the Africa financial-sector intrusions Chisel established SOCKS tunnels for covert remote access and lateral movement. This command-line pattern reveals tunneling regardless of the binary name.

Suspicious Scheduled Task Masquerading as Palo Alto Cortex Services

This rule detects creation of a scheduled task named to impersonate Palo Alto Cortex security services. Threat actors targeting African financial institutions used this task name to disguise persistence for their tooling. A security-vendor-themed task name created through schtasks is a masquerading persistence indicator.

Suspicious Cloud Instance Metadata Token Retrieval via Command-Line Tool

This rule detects command-line tools such as curl or PowerShell requesting an access token from a cloud instance metadata endpoint. Attackers query metadata.google.internal, the 169.254.169.254 link-local address, or the Azure managed-identity endpoint to steal short-lived workload tokens after gaining code execution. Harvesting these tokens lets adversaries impersonate cloud service identities.

Suspicious File Download via Certutil URLCache

This rule detects the certutil utility used with urlcache to download a remote file over HTTP, a living-off-the-land technique seen after CVE-2025-31324 exploitation of SAP NetWeaver. Attackers use certutil to retrieve second-stage payloads while evading application controls. This LOLBIN download behavior is rarely legitimate on servers.

Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog

This rule detects PowerShell spawned from the Windows Run dialog that combines Invoke-WebRequest with Start-Process to download and launch a payload. This pattern is used by the Lampion banking malware ClickFix campaign that tricks users into pasting a malicious one-liner. Attackers abuse this social-engineering vector to gain initial code execution while blending into normal user activity.

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

This rule detects command-line access to wallet.dat files, targeted by Gremlin Stealer to harvest cryptocurrency wallet data alongside browser cookies and credentials. Collecting wallet.dat is a common stealer behavior aimed at draining victim crypto assets after exfiltration.

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

This rule detects command-line access to the macOS login.keychain-db file, which Slow Pisces targets to steal stored credentials alongside SSH keys during its developer-focused intrusions. Reading the login keychain exposes saved passwords and tokens for further account compromise.