Sigma detection rules, expert-reviewed

FTP Data Exfiltration via curl with Embedded Credentials

This rule detects curl uploading a file to an FTP server using inline username and password credentials. Unfading Sea Haze uses this method to move staged archives of stolen data to attacker controlled infrastructure.

Antivirus Check and Remote Loader Retrieval in LNK Command Chain

This rule detects a command chain that checks for the ESET kernel service with tasklist and findstr then downloads a remote payload and hands it to MSBuild for execution. This LNK based initial access is used by Unfading Sea Haze.

MSBuild Executing Non-Project File or Remote Payload

This rule detects MSBuild running a file that is not a normal project such as a log file or a payload staged in a public folder. Unfading Sea Haze abuses MSBuild to compile and execute .NET loaders in memory from these staged files.

Suspicious Windows Defender Real-Time Protection Disabled via Policy Registry by Cephalus Ransomware

This rule detects registry changes under the Windows Defender Real-Time Protection policy key that disable on-access and real-time scanning, a defense evasion step used by Cephalus ransomware. Turning off these protections lets the encryptor run without interference.

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

This rule detects the fDenyTSConnections registry value being set to zero, which enables inbound Remote Desktop connections on the host. Sandworm enables RDP to maintain interactive remote access during intrusions.

Suspicious AutoAdminLogon Enabled via Winlogon Registry by RansomHub Ransomware

This rule detects the Winlogon AutoAdminLogon value being enabled, configuring automatic logon of an account without credentials. RansomHub sets this value to maintain access and ensure its payload runs after reboot.

Suspicious PowerShell Hidden Web Download via Invoke-WebRequest by CatB Ransomware

This rule detects a hidden PowerShell or cmd invocation combining Invoke-WebRequest with DownloadData to retrieve a payload, matching the ingress tool transfer behavior emulated for CatB ransomware. Running the download in a hidden window is a common defense evasion tactic for staging follow-on malware.

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

This rule detects rundll32 executing comsvcs.dll against the LSASS process to extract credentials from memory, a technique used by Salt Typhoon. Dumping LSASS provides hashed or plaintext credentials for lateral movement.

Suspicious Scheduled Task Creation Named test3 by Salt Typhoon

This rule detects creation of a scheduled task named test3 via schtasks, a persistence artifact observed in Salt Typhoon intrusions. The generic task name is used to blend malicious persistence into normal task activity.

Suspicious Symbolic Link Evaluation Enabled via fsutil by RansomHub Ransomware

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation, a configuration change RansomHub uses to reach and encrypt files across redirected paths. Enabling these symlink behaviors is uncommon in normal administration.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

This rule detects HTTP requests carrying the X-Middleware-Subrequest header, which Next.js internally uses to prevent middleware recursion and which attackers forge to bypass middleware-based authentication in CVE-2025-29927 as analyzed by Assetnote. A client-supplied value for this header causes the framework to skip auth middleware and return protected content. Because legitimate external clients never send this internal header, its presence strongly indicates an exploitation attempt.

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

This rule detects requests to the Pulse Connect Secure license keys-status API node parameter carrying shell metacharacters. This maps to the command injection flaw where the node name is passed unsanitized into a shell context. An attacker uses this to execute arbitrary operating system commands on the appliance.

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

This rule detects requests to the Pulse Connect Secure TOTP user backup code API containing directory traversal sequences. This maps to the authentication bypass where traversal from the totp endpoint reaches restricted admin and system functions. An attacker uses this to bypass authentication and pivot toward remote code execution.

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

This rule detects unauthenticated POST requests to the ShareFile storage controller upload endpoints carrying a traversal uploadid and archive extraction flags. This maps to CVE-2023-24489 where a cryptographic flaw allows uploading and unzipping an ASPX webshell outside the intended directory. An attacker uses this to achieve remote code execution and persistence.