Sigma detection rules, expert-reviewed

Malicious Team9 Persistence via BackUp Mgr Run Key

This rule detects creation of a Run key value named BackUp Mgr, a masquerading autostart entry used by the Team9 malware family to gain persistence at user logon. The benign-looking value name in an autorun location combined with a non-standard payload path is a strong indicator of Team9 persistence.

Malicious NetHealth Run Key Persistence

This rule detects creation of a NETHEALTH autorun value under the CurrentVersion Run key pointing to a NetHealth executable in AppData Roaming, the persistence mechanism used in the Rapid Breach intrusion to relaunch the implant at logon. A masqueraded health-monitor name running from a user profile path indicates malicious persistence.

Suspicious Rogue Machine Account Creation via Powermad New-MachineAccount

This rule detects use of the Powermad New-MachineAccount cmdlet to create a rogue computer account in Active Directory, the first step of a resource-based constrained delegation attack that leads to privilege escalation. Creation of attacker-controlled machine accounts through this tooling is a strong indicator of an RBCD abuse chain.

Malicious Dropbox Cloud C2 via Spoofed Googlebot User Agent

This rule detects web traffic to the Dropbox content API using a spoofed Googlebot user agent which the RokRat implant used for command and control as analysed by NCC Group. Abusing a legitimate cloud storage API with a crawler user agent lets the malware blend exfiltration and tasking into normal web traffic.

Malicious MetaStealer C2 via cpp-httplib User-Agent (via proxy)

This rule detects outbound web requests presenting the cpp-httplib user-agent to the MetaStealer tasking endpoints such as api/client/new and tasks/get_worker. The combination of the library user-agent and these fixed URIs is a specific C2 fingerprint. Matching it surfaces hosts beaconing to MetaStealer infrastructure to register and receive stealer tasks.

Malicious Fivehands Go Encryptor Execution via Command Line Flags

This rule detects execution of the Fivehands Go based file encryptor identified by its characteristic command line flags key path blocks and full as described in NCC Group Fivehands ransomware research. The operator invokes the encryptor with a supplied key and target path to encrypt files and append the crypt extension which is the destructive final stage of the intrusion.

Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration

This rule detects execution referencing a Rclone configuration file masquerading as a Windows host process file which Conti operators use to exfiltrate data to cloud storage. Observed in NCC Group research on Conti operations after the leaks using a renamed Rclone binary with a svchost.conf configuration. Cloud exfiltration via renamed Rclone is a common ransomware pre-encryption step.

Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling

This rule detects loading of a rogue netfilter kernel module used by the freenode Linux backdoor to implement magic-packet traffic signaling. Observed in NCC Group research analyzing the Linux backdoor from the freenode IRC network compromise which installs an ipt_ip_udp module hooking PREROUTING. Rogue kernel modules that enable covert wake-on-packet backdoors are a strong indicator of rootkit activity.

Malicious Kubernetes Node Escape via chroot to Node kubectl Path

This rule detects a chroot into the node-local kubectl directory used on managed Kubernetes nodes, a container-to-node escape technique observed in real-world cluster attacks after landing in a privileged pod. Breaking out to the node host filesystem gives the attacker control over the worker node and any credentials stored on it.

Malicious Antivirus Removal via WMIC Product Uninstall

This rule detects abuse of wmic.exe to enumerate installed products through the product class and invoke their uninstall method non-interactively, a technique used by LemonDuck first-stage payloads to silently remove antivirus and endpoint protection. Stripping defensive software before the next stage runs weakens host protections and lets the attacker operate undetected.

Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host

This rule detects the Windows script host executing a VBScript from a non standard ProgramLogs directory used in the Lazarus shellcode execution chain analysed by NCC Group. Placement of scripts in an atypical top level folder is a masquerading and staging technique preceding shellcode injection.

Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse

This rule detects the Cisco AnyConnect agent or downloader spawning a Windows script host to run OnConnect or OnDisconnect scripts which NCC Group showed can be abused to drop and execute attacker payloads on VPN connect events. Abusing the trusted VPN client for script execution evades application allow lists and provides connection triggered persistence.

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

This rule detects use of fsutil to delete the NTFS USN change journal which NotPetya performed to destroy filesystem forensic evidence as documented by NCC Group. Deletion of the change journal removes records of file activity and is rarely part of legitimate administration.

Suspicious Scheduled Task Creation for System Reboot via Schtasks

This rule detects creation of a scheduled task that invokes shutdown with a forced restart which NotPetya used to reboot hosts into its encryption phase as reported by NCC Group. A scheduled forced reboot combined with disk tampering is a hallmark of destructive ransomware execution.

Suspicious Scheduled Task Masquerading as Google Chrome Updates via Process Creation

This rule detects creation of a scheduled task named to impersonate a Google Chrome update mechanism which Lorenz ransomware uses for persistence. Observed in NCC Group research unmasking Lorenz ransomware tactics techniques and procedures. Attackers disguise persistence as a benign updater which makes this named-task masquerade a useful detection point.