Sigma detection rules, expert-reviewed

Malicious Registry Hive Dump via reg save

This rule detects reg.exe saving the SYSTEM, SAM, or SECURITY registry hives to disk, a credential-access technique used by Winnti in Operation CuckooBees to extract cached secrets and password hashes. Attackers export these hives for offline extraction of account credentials. Saving these particular hives is rarely legitimate outside backup tooling and strongly indicates credential theft.

Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument

This rule detects rundll32 loading a sqlite3 DLL by ordinal export #138 together with an x64.tlb argument, the loader invocation used by the Winnti arsenal in Operation CuckooBees. Attackers disguise the malicious payload as a legitimate sqlite3 library and pass a type-library file to trigger execution. This precise ordinal-and-tlb combination is a high-confidence Winnti loader indicator.

Suspicious Symlink Evaluation Enabled via fsutil

This rule detects fsutil being used to enable remote-to-local and local-to-remote symbolic link evaluation, a preparatory action BlackCat/ALPHV ransomware performs to reach and encrypt files across mounted and networked paths. Attackers enable this so encryption can follow symlinks to additional data. This uncommon fsutil configuration change is a distinctive BlackCat pre-encryption step.

Suspicious Scheduled Task Created by Windows Script Host

This rule detects a logon-triggered scheduled task being created by wscript.exe or cscript.exe, the persistence step in the GootLoader infection chain. Attackers register a script-host scheduled task so the loader re-executes at each user logon. A Windows Script Host process registering a scheduled task is uncommon and points to script-based persistence.

Suspicious Reverse Shell via Dev TCP or Netcat

This rule detects Linux reverse-shell construction using bash /dev/tcp redirection or netcat with command execution, techniques used to obtain remote access after ActiveMQ CVE-2023-46604 exploitation. Attackers open these outbound shells to control the compromised broker interactively. These reverse-shell patterns are hallmark hands-on-keyboard command-and-control indicators.

Suspicious Base64 Decoded Payload Piped to Shell

This rule detects an echoed base64 blob being decoded and piped directly into an interactive shell on Linux, an obfuscated execution technique used after ActiveMQ CVE-2023-46604 exploitation. Attackers use this to hide payload contents and run commands without dropping a file. Chaining base64 decode into bash is rarely legitimate and indicates obfuscated code execution.

Suspicious Shell Spawned by ActiveMQ Java Process

This rule detects a Linux shell being spawned as a child of an Apache ActiveMQ Java process, the exploitation pattern of CVE-2023-46604 remote code execution. Attackers trigger the deserialization flaw to run shell commands and fetch second-stage payloads. A Java broker process launching an interactive shell is a clear post-exploitation signal.

Suspicious PsExec Service Named Sliver

This rule detects PsExec lateral movement where the remote service is created with the name Sliver, a default artifact left by the Sliver C2 framework PsExec module. Attackers use this to move laterally and execute payloads under the SYSTEM account on remote hosts. The hardcoded service name is a high-confidence indicator of Sliver operator activity.

Suspicious Named Pipe Pipe2PortCtrl Created by Winnti Malware

This rule detects creation of the named pipe Pipe2PortCtrl, an internal communication channel used by Winnti malware components in Operation CuckooBees. Attackers use this hardcoded pipe for inter-module signaling and port-control coordination on the host. The specific pipe name is a distinctive artifact of the Winnti toolkit.

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

This rule detects trusted signed executables side-loading helper DLLs commonly abused for DLL search-order hijacking such as GUP.exe loading libcurl.dll or MsMpEng.exe loading mpsvc.dll. This technique was widely abused by PlugX and related tooling to run malicious code under the guise of a legitimate signed process, and the rule filters the legitimate Windows Defender load path.

Malicious Madgicx Plus Chrome Extension Identifiers on Disk

This rule detects filesystem artifacts referencing the malicious Chrome extension identifiers distributed in the Madgicx Plus campaign for session-token theft. Presence of these specific extension IDs on disk indicates installation of the credential-stealing browser extension.

Cleo Autorun Exploitation via Healthcheck File Drop

This rule detects healthcheck.txt or healthchecktemplate.txt files written into a Cleo autorun directory, the file drop that triggers command execution when exploiting CVE-2024-55956. Placing these files in the monitored autorun folder causes Cleo software to execute attacker Bash or PowerShell commands.

Malicious Madgicx Plus Extension C2 Domain Resolution

This rule detects DNS resolution of the madgicx-plus.com command-and-control domain used by the Madgicx Plus malicious Chrome extension campaign to receive stolen session tokens. Resolution of this attacker-controlled domain from an endpoint indicates a compromised browser exfiltrating authentication material.

Suspicious Microsoft Office Test Persistence Key Creation (via registry_set)

This rule detects creation or modification of the Office test Special Perf registry value which forces Microsoft Office applications to load an arbitrary DLL at startup. This rarely used key gives adversaries stealthy persistence through trusted Office processes.

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

This rule detects modification of the BootVerificationProgram ImagePath registry value which the Service Control Manager launches at boot instead of the default boot verification routine. Adversaries abuse this rarely used key to gain SYSTEM level persistence that survives reboots.