Sigma detection rules, expert-reviewed

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

This rule detects command-line access to wallet.dat files, targeted by Gremlin Stealer to harvest cryptocurrency wallet data alongside browser cookies and credentials. Collecting wallet.dat is a common stealer behavior aimed at draining victim crypto assets after exfiltration.

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

This rule detects command-line access to the macOS login.keychain-db file, which Slow Pisces targets to steal stored credentials alongside SSH keys during its developer-focused intrusions. Reading the login keychain exposes saved passwords and tokens for further account compromise.

Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)

This rule detects creation of a scheduled task named w32analytics that executes rundll32 against w32analytics.dll, a persistence mechanism observed in recent unusual malware analyzed by Unit 42. Combining scheduled task persistence with rundll32 proxy execution lets the loader run its DLL export on a recurring basis while evading direct binary controls.

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

This rule detects the renamed Windows debugger cdb.exe masquerading as fontdrvhost.exe in C:\ProgramData and loading shellcode from config.ini, a loader used by the Squidoor backdoor. Running the signed cdb LOLBin under a spoofed name from a non-standard path proxies malicious code execution past application controls.

Malicious curl Download From Fake Apple Ads Domain on macOS (via process_creation)

This rule detects curl retrieving payloads from the apple-ads-metric staging domain used to deliver npm and back.sh second-stage scripts in the macOS crypto-sector intrusion. Downloading follow-on tooling from this Apple-themed domain marks the ingress tool transfer stage of the attack.

Suspicious mdfind Search for Private Key Files on macOS (via process_creation)

This rule detects use of mdfind to enumerate .pem private key files across a macOS system, a discovery step used by the RustDoor and Koi Stealer campaign to locate credentials in files. Bulk searching for private keys precedes theft of SSH and certificate material for lateral movement and account access.

Malicious curl Exfiltration to Attacker Upload Endpoint on macOS (via process_creation)

This rule detects curl multipart form uploads to the /tasks/upload_file endpoint used by a North Korea-linked actor to exfiltrate stolen files from macOS crypto-sector targets. The RustDoor and Koi Stealer chain uploads harvested credentials and wallet data to attacker-controlled servers such as visualstudiomacupdate over this path.

Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)

This rule detects modification of /etc/ld.so.preload to load libcext.so.2, the shared object used by the Auto-Color backdoor to hook libc functions and hide its network connections. This dynamic linker hijack provides rootkit-like concealment and persistence across all dynamically linked processes.

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

This rule detects processes referencing the /Users/Shared/NW staging directory used by the Cthulhu macOS stealer to collect harvested data before exfiltration. Use of this world-writable shared path for staging is a strong indicator of stealer activity preparing collected browser and wallet data.

Suspicious MSBuild Inline Task Compilation of mini.xml

This rule detects MSBuild executing the project file mini.xml to compile and run inline code. This behavior matches post-exploitation of Ivanti CVE-2025-0282 where a msbuild.lnk shortcut invoked MSBuild as a trusted developer utility to execute attacker code. MSBuild compiling arbitrary XML project files is a proxy execution technique used to bypass application controls.

Suspicious AdFind Domain User Reconnaissance Output

This rule detects command lines writing to the reconnaissance output file Domain_users_light.txt associated with AdFind based Active Directory enumeration. This behavior matches intrusions that rename AdFind to a.logs and dump domain user objects for targeting. Structured directory enumeration output is a discovery indicator that commonly precedes lateral movement and Kerberoasting.

Malicious Container Escape via chroot to Host Mount

This rule detects a process invoking chroot into a mounted host filesystem path from within a privileged container. This behavior matches Dirty DAG where an attacker ran a privileged pod that mounted and chrooted into the underlying node to escape the container. Chrooting into a host mount is a definitive container escape technique granting node-level control.

Suspicious Azure WireServer Access via curl from Container

This rule detects command-line HTTP requests to the Azure host WireServer at 168.63.129.16 from a container or node. This behavior matches Dirty DAG where an attacker queried the Azure fabric and instance metadata to steal managed identity tokens. Direct curl or wget access to the WireServer address from workloads is anomalous and indicates cloud credential harvesting.

Suspicious Kubernetes Permission Enumeration via kubectl auth can-i

This rule detects enumeration of granted Kubernetes permissions via kubectl auth can-i --list. This behavior matches the Dirty DAG exploitation of Azure Data Factory Airflow where an attacker inside a compromised pod mapped its privileges before escalating. Permission enumeration from a workload context is an early reconnaissance step toward cluster takeover.

Malicious ESXi Syslog Redirection to tmp via esxcli

This rule detects reconfiguration of the ESXi syslog log directory to a volatile tmp location via esxcli. This behavior matches Akira ransomware operators targeting VMware ESXi who redirect logs to erase forensic evidence before encrypting virtual machines. Pointing syslog at tmp destroys audit trails and is a defense evasion step tied to hypervisor-level ransomware attacks.