Sigma detection rules, expert-reviewed

Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)

This rule detects wscript.exe spawning rundll32.exe to call the IternalJob export, the execution chain used by the BumbleBee loader launched from a VBS script via a scheduled task. The misspelled IternalJob export name is a specific loader artifact. This chain proxies malicious code execution through a signed binary to load BumbleBee and stage follow-on payloads.

Suspicious AnyDesk Unattended Password Set via Piped Echo

This rule detects an AnyDesk unattended-access password being configured by piping a value through echo into the --set-password parameter, a scripted technique used by threat actors to enable silent remote access without user interaction. Programmatic password provisioning to AnyDesk is a strong indicator of malicious remote-access setup.

Malicious Data Exfiltration via MinIO Client from Windows Temp

This rule detects execution of the MinIO client with a config directory placed under Windows Temp as vmware.x combined with the insecure recursive copy flags used by the SnapMC actor to exfiltrate stolen data to attacker object storage. The masqueraded config path with TLS verification disabled is a strong indicator of automated bulk exfiltration.

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

This rule detects discovery command output being redirected into the Qlik Sense web-served fonts directory using the qle.ttf or qle.woff filenames, a data-staging technique used by Cactus ransomware operators after exploiting Qlik Sense to make recon results retrievable over HTTP. Writing whoami or quser output into a webroot fonts path is a strong indicator of hands-on-keyboard exploitation.

Suspicious Data Exfiltration to Backblaze B2 via rclone (via process_creation)

This rule detects rclone copying data to a Backblaze B2 remote which was used to stage stolen data prior to BitLocker ransomware deployment. rclone to cloud storage is a common double-extortion exfiltration channel. Bulk transfer of files to attacker-controlled cloud storage precedes extortion and public leak threats.

Malicious DCSync Credential Dumping Tooling via Command Line (via process_creation)

This rule detects command lines invoking known DCSync implementations such as the mimikatz lsadump dcsync module or impacket secretsdump. These tools request directory replication to extract account password hashes from a domain controller. Recovering domain hashes including krbtgt enables golden ticket forgery and full domain compromise.

Suspicious Direct etcd Database Access via etcdctl With Server Certificates (via process_creation)

This rule detects execution of etcdctl using the etcd server certificates and the local etcd endpoint to read or write cluster state directly. Post-exploitation of a compromised etcd in Kubernetes clusters abuses this path to bypass the kube-apiserver and its admission controls. Direct database access lets an attacker read secrets or inject resources with full control over the cluster.

Malicious Inbox Rule Hiding Security Mail to RSS Feeds via M365 (via m365)

This rule detects creation of an Exchange Online inbox rule that moves messages into the RSS Feeds folder and marks them as read. This is a common business email compromise technique to hide security notifications and replies from the compromised user. Concealing warning mail lets the attacker operate the mailbox and pursue fraud undetected.

Malicious Kubernetes Reconnaissance Tooling Activity

This rule detects Kubernetes reconnaissance and attack tooling either via the Rakkess access matrix user agent or the deployment of known offensive container images such as kubiscan kube-hunter and kubestriker as described in NCC Group Kubernetes detection engineering research. Adversaries run these tools to map RBAC permissions and hunt for cluster misconfigurations before privilege escalation.

Malicious DLL Sideloaded by Microsoft Office Application

This rule detects a Microsoft Office application loading one of the specific DLLs abused for the MS15-132 DLL hijack such as elsext dll oci dll and the winrt forwarder library as described in NCC Group Office DLL hijacking research. Adversaries deliver a document with an OLE object via the browser that drops a malicious DLL next to the document so Office resolves and executes attacker code for initial access.

Malicious Office Persistence via WLL Add-In Dropped to Word STARTUP Folder

This rule detects creation of a Word add-in library file in the Microsoft Word STARTUP folder which the Sisfader RAT uses for persistence after CVE-2017-8570 exploitation. Observed in NCC Group research on CVE-2017-8570 RTF documents delivering the Sisfader RAT via an SCT to WLL chain. WLL add-ins auto-load with Word which makes this a reliable persistence detection.

Suspicious File Written to Startup Folder by DllHost COM Surrogate

This rule detects dllhost.exe writing files into the user Startup folder, matching Blister loader behaviour that abuses the IFileOperation COM interface via the DllHost surrogate to copy its payload for persistence while evading direct file-write monitoring. The COM surrogate is rarely a legitimate producer of Startup persistence artifacts and indicates staging of an auto-run payload.

Suspicious Rundll32 Copied to Startup Folder via Blister Loader

This rule detects a copy of rundll32.exe being written into the user Startup folder, a persistence technique used by the Blister loader which drops rundll32.exe alongside its own payload DLL to auto-run at logon. Placing a legitimate system binary outside System32 in a Startup path is a strong sign of DLL proxy execution being staged for persistence.

Malicious Kernel Driver Load from User AppData Directory

This rule detects loading of known malicious kernel driver file names from a user AppData directory which is an abnormal location for signed drivers. NCC Group attributed netfilter and related drivers to a rootkit that manipulates network traffic and hides malicious activity. Loading a driver from a writable user path indicates rootkit installation and kernel level defense evasion.

Possible Team9 C2 via Emercoin bazar Domain Resolution

This rule detects DNS queries for domains under the Emercoin .bazar top-level domain used by the Team9 malware family for resilient command-and-control. Resolution of a .bazar name from an enterprise host is highly unusual and strongly suggests a blockchain-based C2 channel.