Sigma detection rules, expert-reviewed

Suspicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects the wevtutil utility clearing Windows event logs, an anti-forensic step Repellent Scorpius uses to destroy evidence during Cicada3301 ransomware intrusions. Wiping event logs hinders incident response and hides the actor's earlier activity.

Malicious Inhibit System Recovery via Shadow Copy and Boot Config Tampering (via process_creation)

This rule detects deletion of Volume Shadow Copies via vssadmin or wmic and disabling of Windows recovery via bcdedit, the recovery-inhibition sequence Repellent Scorpius runs before deploying Cicada3301 ransomware. Destroying backups and recovery options maximizes encryption impact and pressures victims to pay.

Suspicious Data Exfiltration to Dropbox via curl (via process_creation)

This rule detects the curl utility uploading data to the Dropbox API, a channel Stately Taurus used to exfiltrate rar archives of stolen files from compromised government networks. Exfiltration through a trusted cloud storage provider blends with normal web traffic and evades data-loss controls that whitelist Dropbox.

Malicious zqtxmo Batch Script Execution by Fighting Ursa

This rule detects execution of the zqtxmo.bat batch script run by Fighting Ursa after a sideloaded DLL entry point, a stage that launches msedge with a base64 argument to reach its webhook based command and control. The named batch file is a distinctive artifact of this infection chain. Detecting it exposes the follow-on execution stage of the campaign.

Suspicious Double Extension Image Executable by Fighting Ursa

This rule detects execution of a file using a deceptive image double extension ending in jpg.exe, the disguise Fighting Ursa applies to a renamed calc.exe delivered in its car-for-sale phishing lure. The double extension tricks users into launching a program that appears to be a photo. Detecting this exposes user execution of the masqueraded first-stage binary.

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Suspicious SUID Bit Set on Binary from Container Context

This rule detects the setuid bit being applied to a binary via chmod, a privilege escalation step used after container escapes to leave a root-owned SUID backdoor on the host. Creating a SUID binary provides a durable path back to root. Detecting this exposes privilege escalation and persistence following a breakout.

Suspicious Docker Socket Access via curl Unix Socket for Container Escape

This rule detects curl talking to the Docker daemon over its Unix socket to create or start containers, a technique used to escape a container by spawning a privileged sibling with the host filesystem mounted. Direct access to docker.sock grants effective root on the node. Detecting this exposes an attempted breakout through the exposed Docker API.

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell wscript or cscript, the initial execution DarkGate triggers when a lure workbook launches an embedded object to pull remote scripts over SMB. Office applications launching script hosts is a strong indicator of malicious document activity. Detecting this parent-child relationship exposes the DarkGate delivery stage.

Suspicious AutoHotkey Script Execution from User Writable Path by DarkGate

This rule detects the AutoHotkey interpreter running an ahk script, the execution stage DarkGate reaches after reconstructing AutoHotKey.exe and launching script.ahk to carry out its malicious logic. AutoHotkey provides a scripting runtime that adversaries repurpose for command and control and payload handling. Detecting interpreter plus script execution exposes the DarkGate second stage.

Malicious certutil Decodehex Payload Reconstruction by DarkGate

This rule detects certutil being run with the decodehex option to reconstruct a binary from a downloaded hex-encoded file, a step DarkGate uses to rebuild an AutoHotkey interpreter from a dropped a.bin file. Abusing certutil for decoding is a living-off-the-land technique that evades signature-based download controls. Detecting this exposes payload deobfuscation during the DarkGate infection chain.

Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400

This rule detects the PAN-OS running configuration being copied or staged into a web-accessible file carrying a .css extension, a behavior observed in Operation MidnightEclipse exploiting CVE-2024-3400. Attackers rename running-config.xml to a stylesheet so the device configuration can be retrieved over the management web interface. Detecting this exposes hands-on-keyboard post-exploitation and configuration theft on the firewall.

Malicious Linux Payload Download and Execution Chain via Wget and Chmod (via process_creation)

This rule detects a shell command chain that fetches a binary with wget into tmp, grants it full execute permissions with chmod 777, and prepares it to run, the classic exploitation payload staging seen in the botnet scanning campaigns abusing Zyxel and Ivanti flaws. This download and execute sequence over a single command line reflects automated post exploitation rather than legitimate package management.

Suspicious EACoreServer Masquerading as WindowsUpdate Executable (via process_creation)

This rule detects a process launched as WindowsUpdate.exe whose original file name is EACoreServer.exe, the renaming trick a Chinese APT used to disguise a legitimate signed binary as a Windows update component for sideloading. The mismatch between the on disk name and the embedded original name exposes the masquerade, distinguishing it from genuine update processes.

Suspicious StrelaStealer DLL Execution via Rundll32 Hello Export from Temp (via process_creation)

This rule detects rundll32.exe invoking the hello export of a DLL located in an AppData or temp directory, the loader behavior StrelaStealer uses to run its stealer payload dropped by a JScript file. The combination of a proxy execution binary, a user writable path, and the campaign specific export name reflects the StrelaStealer execution stage rather than normal library invocation.