Sigma detection rules, expert-reviewed

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

This rule detects execution of The Gentlemen ransomware Go encryptor invoked with its signature command line flags controlling self propagation and fast encryption. The presence of these operator flags together indicates active deployment of a self-propagating encryptor and imminent data destruction across the environment.

Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)

This rule detects sqlite3 being used to read or write the macOS TCC.db privacy database, an injection technique Sapphire Sleet uses to grant itself access to protected resources without user consent. Adversaries tamper with TCC.db to bypass macOS privacy controls covering the camera, microphone, and full disk access, so direct sqlite3 access to this database is a strong indicator of privacy-control subversion.

Malicious Sapphire Sleet curl to osascript Chain With mac-cur User-Agent (via process_creation)

This rule detects a curl download piped into osascript while using the distinctive mac-cur user-agent, the staged execution chain Sapphire Sleet uses after a fake software update to fetch and run AppleScript payloads on macOS. Adversaries use this pattern to pull second-stage code and execute it in memory, so the mac-cur marker combined with curl and osascript exposes the intrusion at the download-and-execute stage.

Malicious React Server Component RCE via Node Web Process Spawning Shell (via process_creation)

This rule detects a Node.js or Next.js server process spawning a shell that runs reconnaissance or download commands such as whoami, curl, or wget, the exploitation pattern for the CVE-2025-55182 React2Shell flaw in React Server Components. Adversaries trigger this to gain remote code execution on internet-facing servers before dropping miners and RATs, making the web-process-to-shell chain an early signal of active exploitation.

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

This rule detects registration or use of a self-hosted GitHub Actions runner named SHA1HULUD, a distinctive artifact of the Shai-Hulud 2.0 supply chain worm as it establishes persistence in victim GitHub organizations. Adversaries register attacker-controlled runners to execute workflows and exfiltrate secrets from CI pipelines, so the hardcoded runner name is a high-confidence indicator of an active compromise.

Suspicious Remote Monitoring Tool Executing from GoAnywhere Directory

This rule detects remote monitoring and management tools such as SimpleHelp or MeshAgent executing from within a GoAnywhere installation directory. Microsoft observed attackers deploying these RMM tools under GoAnywhere folders following CVE-2025-10035 exploitation to maintain access. RMM binaries running from a file-transfer application path are out of place and indicate attacker-installed remote access.

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

This rule detects the GoAnywhere Tomcat process spawning powershell or cmd running host discovery commands such as whoami and systeminfo. Microsoft observed this chain during active exploitation of CVE-2025-10035 in GoAnywhere Managed File Transfer. A file-transfer web application launching reconnaissance commands indicates post-exploitation hands-on activity.

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

This rule detects certutil.exe adding a certificate to the root or CA store using the addstore and Enterprise options. Microsoft observed Secret Blizzard installing a rogue root certificate to enable adversary-in-the-middle interception of diplomat traffic. Trusting an attacker root certificate allows silent TLS decryption, so this command reveals the interception setup.

Malicious Marbled Dust Backdoor Executing from Public Videos Directory

This rule detects execution of OMServerService.exe from the c\users\public\videos path. Microsoft attributed this GoLang backdoor to Marbled Dust in the Output Messenger espionage campaign. A service executable running from a world-writable public media folder is a clear misplacement of a legitimate-looking name, marking it as the deployed backdoor.

Suspicious Microsoft Defender Exclusion Added for TEMP and PowerShell via Add-MpPreference

This rule detects use of Add-MpPreference to add Microsoft Defender exclusions for the user TEMP directory and the powershell.exe process. This behavior was observed in Node.js malvertising campaigns tracked by Microsoft that stage malicious payloads in TEMP. Attackers use it to blind endpoint protection before executing staged malware, so alerting on it exposes early defense evasion.

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

This rule detects the China Chopper web shell command marker &cd&echo in commands run by the IIS worker process, a hallmark of the web shells deployed against on-premises Exchange and SharePoint servers in these attacks. Adversaries use China Chopper to execute arbitrary commands through a compromised web application, so this distinctive command wrapper spawned by w3wp is a high-confidence web-shell indicator.

Malicious System Recovery Inhibition via bcdedit and wbadmin before Ransomware (via process_creation)

This rule detects recovery-inhibition commands that disable Windows automatic recovery via bcdedit or delete the backup catalog via wbadmin, the pre-encryption destruction step in the CLFS zero-day intrusion that led to ransomware. Adversaries remove recovery options to maximize damage and pressure victims, so these commands appearing together with staging activity are a critical pre-ransomware indicator.

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

This rule detects a hex or base64 encoded blob being decoded with xxd or base64 and piped directly into a shell, the obfuscated execution technique used by the updated XCSSET macOS malware to run its payloads. Adversaries encode commands to hide intent from static inspection and decode-and-run them in memory, so a decode utility feeding sh in one pipeline is a reliable indicator of obfuscated script execution.

Malicious IIS Worker Process Spawning Command Shell after ASP.NET ViewState Injection (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command interpreters or reconnaissance utilities, the post-exploitation behavior seen when adversaries inject code through publicly disclosed ASP.NET machine keys to execute the Godzilla framework on an IIS server. Attackers use forged ViewState payloads validated by leaked machineKey values to run arbitrary commands in the web server context, making this parent-child pattern a strong indicator of server compromise before further lateral movement.

Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)

This rule detects the SIP-heritable daemon storagekitd spawning a third-party filesystem binary located under /Library/Filesystems, the core behavior of the macOS System Integrity Protection bypass tracked as CVE-2024-44243. Adversaries abuse storagekitd com.apple.rootless.install.heritable entitlement to run attacker-controlled newfs and fsck helpers with SIP-bypassing privileges, making early detection critical for stopping kernel extension loading and rootkit installation.