Sigma detection rules, expert-reviewed

Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Any Protocol (via security)

This rule detects modifies host delegation settings for privilege escalation.

Malicious Webserver IIS Configuration Edited - SYSMON (via file_event)

This rule detects edit IIS configuration file in order to load a module.

Malicious SQL Server Lateral Movement with CLR Activation (via application)

This rule detects enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.

Untrusted Disabling of macOS Gatekeeper via Spctl (via process_creation)

This rule detects spctl --master-disable, which turns off Gatekeeper so unsigned and unnotarized applications can run without warning, a defense-evasion step preceding malware execution on macOS. Disabling Gatekeeper is a technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces an attacker removing code-signing enforcement.

Malicious SQL Server Auditing Deactivated (via application)

This rule detects deactivates SQL Server auditing capacities. SQL auditing requires previous configuration on each SQL instance.

Obfuscated Massive Service Failures - Tchopper (via system)

This rule detects uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

This rule detects wuauclt.exe invoked with UpdateDeploymentProvider and RunHandlerComServer arguments, which loads an attacker DLL through the Windows Update client, a signed-binary proxy technique. Wuauclt abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces trusted-binary DLL loading.

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

This rule detects reg.exe saving the SAM, SYSTEM or SECURITY registry hive to disk, which lets an attacker extract local credential material and boot keys for offline hash recovery. Registry hive dumping is a credential-access technique documented in the Red Canary Threat Detection Report. Detecting these save commands surfaces local credential theft in progress.

Malicious Read Access to the Linux Shadow Password File (via process_creation)

This rule detects a shell or file utility reading /etc/shadow, the file holding Linux password hashes, which adversaries copy to crack credentials offline. OS credential access on Linux hosts supports the lateral movement and escalation documented in the Red Canary Threat Detection Report. Because /etc/shadow is normally accessed only by system authentication components, ad-hoc reads by cat, cp or editors are a strong credential-theft indicator.

Malicious UAC Bypass via sdclt Handler Hijack (via registry_set)

This rule detects modification of the HKCU exefile runas isolatedCommand or Folder shell open command keys that sdclt.exe consults, a registry hijack used to auto-elevate an attacker command without a UAC prompt. This sdclt handler hijack is a privilege-escalation technique tracked in the Red Canary Threat Detection Report. Detecting the key change surfaces a UAC-bypass being staged.

Malicious Winlogon Shell or Userinit Persistence Modification (via registry_set)

This rule detects modification of the Winlogon Shell or Userinit values, which are executed at every interactive logon and are abused to launch a payload persistently with the user's session. Winlogon helper persistence is a technique tracked in the Red Canary Threat Detection Report. Detecting changes to these keys surfaces a logon-triggered persistence foothold.

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

This rule detects rclone being run with copy, sync or move operations to a cloud remote, the staging-and-exfiltration tool ransomware crews use to bulk-transfer stolen data before encryption. Data exfiltration over cloud storage is documented in the Red Canary Threat Detection Report as a hallmark of double-extortion intrusions. Detecting rclone transfer commands surfaces exfiltration during the critical window before impact.

Malicious Diskshadow Command Abuse to Expose VSS Backup (via process_creation)

This rule detects attemps to create an IFM for dumping credentials.

Malicious Houken PHP Webshell Written into Ivanti CSA Webroot via Shell Redirection (via process_creation)

This rule detects a shell dropping a PHP webshell into the Ivanti Cloud Service Appliance LANDesk broker webroot by echoing PHP code that invokes system() or eval() on request parameters, the initial-access behavior used by the Houken intrusion set after exploiting Ivanti CSA zero-days. Adversaries leverage this to obtain a persistent command channel on the appliance, making early detection critical for catching perimeter compromise before rootkit deployment and lateral movement.

Malicious Tampering With Windows Defender Protection (via process_creation)

This rule detects command-line attempts to disable core Microsoft Defender protections, such as turning off real-time monitoring through Set-MpPreference or adding broad exclusions, or stopping and disabling the WinDefend service. Impairing endpoint defenses is a common defense-evasion step in the Red Canary Threat Detection Report, clearing the way for follow-on tooling to run undetected. Detecting these tamper commands surfaces the adversary weakening the host before further action.