Sigma detection rules, expert-reviewed

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

This rule detects a Microsoft Office application spawning regsvr32 or rundll32 to load a DLL from a user-writable path such as AppData, Temp or ProgramData, the macro-driven loader pattern used by families like Emotet to execute their payload after a malicious document is opened. This document-to-DLL execution chain is documented in the Red Canary Threat Detection Report. Detecting the Office-to-DLL proxy execution surfaces the intrusion at the initial-access boundary.

In-Memory AMSI or ETW Bypass in PowerShell (via process_creation)

This rule detects PowerShell command lines containing AMSI or ETW bypass constructs (AmsiScanBuffer, amsiInitFailed, System.Management.Automation.AmsiUtils or EtwEventWrite patching), which blind script scanning and telemetry so malicious code runs undetected. AMSI and ETW tampering is a defense-evasion technique highlighted in the Red Canary Threat Detection Report. Detecting these strings surfaces an attacker disabling instrumentation before executing a payload.

Malicious Service Permissions Hijacked for Privileges Abuse - Service (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

Malicious Service Abuse with Backdoored "command Failure" - Service (via process_creation)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

CMSTP Execution of an INF Profile (via process_creation)

This rule detects cmstp.exe processing an INF connection profile, including remote profiles, a signed-binary proxy technique used to run commands and bypass application allowlisting and UAC. CMSTP abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-installer abuse for code execution.

Malicious Account Set with Reversible Encryption - Weakness Introduction (via security)

This rule detects set an account with reversible encryption to facilitate brutforce or cracking operations.

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via Command (via process_creation)

This rule detects modify the permissions of a service in order to abuse its privileges.

Malicious Network Share Manipulation via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Malicious Microsoft Defender Critical Security Components Disabled - Command (via process_creation)

This rule detects disable Defender security features.

Malicious User Password Change Without Previous Password Known - SetNTLM - Mimikatz (via security)

This rule detects perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.

Malicious Mimikatz Driver Registration - Reg via Sysmon (via registry_event)

This rule detects installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

Malicious Microsoft Defender Service Deactivation Attempt - Command (via process_creation)

This rule detects disable Defender security service. If tamper protection is enabled, this action may not work.

Malicious LSASS Dump via Process Access (via process_access)

This rule detects attempt to dump LSASS process with tools like Mimikatz.

Malicious Remote Script Piped Directly to a Shell (via process_creation)

This rule detects curl or wget output piped straight into sh or bash on Linux, a one-line download-and-execute pattern used to fetch and immediately run a remote payload. Piping a downloaded script to a shell is an ingress-and-execution technique tracked in the Red Canary Threat Detection Report. Detecting this chain surfaces remote code execution as it happens.

Malicious Cryptocurrency Miner Execution (via process_creation)

This rule detects command lines carrying cryptomining indicators such as stratum pool URLs, --donate-level or known miner names, a resource-hijacking impact technique that runs coin miners on compromised Linux hosts. Cryptomining is tracked in the Red Canary Threat Detection Report. Detecting these arguments surfaces unauthorized use of compute resources.