Sigma detection rules, expert-reviewed

Uncommon Mustang Panda pcl2bmp Sideloading Host Executed from Public Documents (via process_creation)

This rule detects the legitimate pcl2bmp binary launched from the Public Documents directory, the DLL side-loading host used to load the malicious ctxmui.dll in the Mustang Panda ZOHOMURK operation against Indian government and energy sectors. Adversaries relocate a signed executable to a world-writable path so it sideloads their loader under a trusted process. Execution of this printer utility from Public Documents is highly anomalous.

Enabling restricted admin mode

Detects the registry modification to enable restricted admin mode using reg.exe

Malicious Inhibition of System Recovery via Shadow Copy or Backup Deletion (via process_creation)

This rule detects command lines that delete volume shadow copies or backups or disable boot-time recovery, using vssadmin, wmic shadowcopy, wbadmin or bcdedit. Inhibiting system recovery is a high-impact technique in the Red Canary Threat Detection Report and a hallmark of ransomware preparing to prevent victims from restoring encrypted data. Detecting these destructive commands provides a critical, high-fidelity signal immediately before or during encryption.

Malicious IIS Application Pool Credential Dumping (via process_creation)

This rule detects scenarios where an attacker.

Malicious RDP BlueeKeep Connection Closed - CVE-2019-0708 (via rdp)

This rule detects exploit the BlueKeep vulnerability.

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious Anonymous Login - Domain Specified (via security)

This rule detects scenarios where a suspicious anonymous login is performed during discovery phases.

Malicious SQL Server Dedicated Admin Connection (DAC) Suspicious Activity (via application)

This rule detects enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

Malicious Service Deactivation - Command (via process_creation)

This rule detects disable.

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

This rule detects enable or reconfigure BitLocker on multiple hosts for ransomware purposes.

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

This rule detects sSH brutforce a Windows OpenSSH server with non existing users.

Malicious Massive Remote Service Creation via Named Pipes - Tchopper (via security)

This rule detects uses the Tchopper tool by remotely creating multiple services via named pipes.

Malicious Audit Policy Disabled by Command Line (via process_creation)

This rule detects disbale or clear the audit policy for defense evasion purposes.

Malicious Shared Folder Access with Forged Golden Ticket (via security)

This rule detects used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump user profile information via network share.