Sigma detection rules, expert-reviewed

Suspicious Rclone Exfiltration via Masqueraded svchost Process Creation

This rule detects a process masquerading as svchost through typosquatted names running Rclone-style transfer arguments, a data exfiltration technique used by Storm-0501 to move stolen files to attacker cloud storage. Renaming Rclone to svhost.exe or scvhost.exe is an attempt to hide exfiltration behind a trusted-looking Windows binary name.

Suspicious LSASS Memory Dump via Procdump Process Creation

This rule detects Procdump being run against the LSASS process to capture a memory dump for offline credential extraction, a technique used by the North Korean actor Moonstone Sleet during intrusions. Dumping LSASS yields plaintext and hashed credentials that enable lateral movement and privilege escalation.

Malicious Forest Blizzard GooseEgg Persistence via WinSrv Scheduled Task as SYSTEM (via process_creation)

This rule detects creation of a scheduled task under the Microsoft Windows WinSrv path running as SYSTEM. Forest Blizzard registered this task with schtasks to persist and run its GooseEgg exploitation tool with elevated privileges.

Malicious Reverse Shell via Netcat or Shell Redirection on Linux (via process_creation)

This rule detects Netcat invoked with a command execution flag or a bash dev tcp redirection used to establish an interactive reverse shell. Attackers exploiting OpenMetadata used these techniques for hands-on access to compromised Kubernetes workloads.

Suspicious curl Download Launched from PDF Shortcut Lure (via process_creation)

This rule detects curl.exe fetching remote content when spawned from a shortcut with a double pdf.lnk extension. Mint Sandstorm delivered fake PDF shortcuts that invoked curl to download follow-on payloads.

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

This rule detects the Windows App Installer binary launching a remote MSIX package through the ms-appinstaller protocol handler and ServerName argument. Financially motivated actors abused this vector to deliver BATLOADER and Cobalt Strike while bypassing SmartScreen.

Malicious TeamCity Persistence via Scheduled Task Masquerading as Settings UI (via process_creation)

This rule detects creation of a scheduled task named Windows TeamCity Settings User Interface. North Korean actors registered this deceptively named task after exploiting TeamCity CVE-2023-42793 to persist their implant on the server.

Malicious Cloud Instance Metadata Token Theft via IMDS Identity Endpoint (via process_creation)

This rule detects command lines requesting an OAuth token from the Azure instance metadata service identity endpoint at 169.254.169.254. Threat actors queried IMDS from a compromised SQL Server host to steal the managed identity token and move laterally into the cloud.

Malicious SQL Server Command Shell Spawn via sqlservr Child Process (via process_creation)

This rule detects the SQL Server engine process sqlservr.exe spawning a command shell or scripting interpreter. Threat actors enabled xp_cmdshell on a compromised SQL Server to run OS commands as a foothold before pivoting to the cloud environment.

Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to a file. Flax Typhoon dumped these hives to extract local account password hashes for offline cracking and credential access.

Malicious PipeMagic Named Pipe Created for Modular Backdoor Communication

This rule detects creation of a named pipe following the PipeMagic pattern where the pipe name begins with 1. followed by a hexadecimal bot identifier. Microsoft documented this pipe naming convention as core to the PipeMagic modular backdoor for inter-module messaging. The distinctive numeric prefix is not used by legitimate software, so a matching pipe indicates the backdoor is active.

Malicious Exchange Inbox Rule Hiding Direct Deposit and Bank Emails via Payroll Pirate Compromise (via m365)

This rule detects Exchange Online inbox rules that move or delete messages mentioning direct deposit, bank, or payroll, an email-hiding technique used by Storm-2755 to conceal payroll change alerts from compromised Canadian employees. Adversaries suppress these notifications so their rerouting of salary payments goes unnoticed, making inbox rules keyed on payment keywords a high-confidence sign of payroll fraud.

Malicious Storm-2561 DLL Sideloading via Fake Pulse Secure Directory (via image_load)

This rule detects DLL sideloading where dwmapi.dll or inspector.dll is loaded from a fake Pulse Secure directory under Common Files, the execution technique used by Storm-2561 to run credential-stealing code under a trusted-looking VPN process. The inspector.dll payload then reads the connectionstore.dat credential store, so loading these modules from the planted directory reveals active theft of VPN and stored credentials.

Suspicious rastls DLL Sideloading by kavp via Image Load

This rule detects the Symantec kavp.exe binary loading rastls.dll from outside a legitimate Symantec installation path, the DLL side-loading technique Secret Blizzard used to execute the Kazuar backdoor while abusing another group's tooling. A trusted security vendor binary loading its companion DLL from an unexpected location indicates a hijacked side-loading pair.

Malicious GigaWiper Ransomware File Extension .candy

This rule detects creation of files with the .candy extension, the marker appended to encrypted files by the GigaWiper destructive backdoor. A burst of files gaining this extension indicates active data destruction and encryption in progress across the host.