Sigma detection rules, expert-reviewed

Suspicious Self-Hosted GitHub Actions Runner Started As Root via Shell (via process_creation)

This rule detects a self-hosted GitHub Actions runner being started with the runner allow run as root flag on Linux hosts. Threat actors register self-hosted runners and force them to run as root to obtain a persistent backdoor with full privileges on the host. A runner explicitly permitted to run as root is highly unusual and warrants review.

Malicious EtherRAT Base64 Decoded Payload Piped To Bash via Shell (via process_creation)

This rule detects a base64 encoded payload being decoded and piped directly into a bash interpreter on Linux hosts. This behavior matches the EtherRAT dropper used by DPRK operators in React2Shell attacks to stage a Node.js implant. Decoding inline to a shell lets the attacker execute code without writing a script to disk which is why this pattern warrants investigation.

Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)

This rule detects Ingress objects whose path field carries a double quote together with nginx configuration directives in Kubernetes audit logs. This matches exploitation of the ingress-nginx configuration injection vulnerabilities where attackers smuggle directives such as return set try_files and ssl_engine into the generated nginx config. A path value containing a quote and nginx directives indicates an attempted configuration injection.

Malicious AWS Cross-Account AssumeRole With Suspicious Session Names via CloudTrail (via aws)

This rule detects AWS STS AssumeRole calls that use session names tied to an AI assisted intrusion which escalated to administrator access. The operators assumed the organization account access role with session names such as pwned escalation and claude-session while pivoting across accounts. Role session names of this kind indicate hands on keyboard privilege escalation.

Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory

This rule detects binaries such as chrome.exe or tunn.exe running from the Windows Tasks directory, where Spirals ransomware operators staged renamed Chisel and tunneling utilities. Legitimate browsers and tools do not execute from this path.

Suspicious PsExec Service Launching Encoded PowerShell Payload

This rule detects the PsExec service process spawning PowerShell with an encoded command, a lateral movement and payload delivery pattern used by Spirals ransomware operators against remote hosts.

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

This rule detects MpCmdRun.exe removing all antivirus definitions and disabling real-time monitoring, a defense evasion step performed by Spirals ransomware operators before deploying the encryptor.

Suspicious Registry Hive Dump via reg save to Disguised evt Files

This rule detects reg.exe saving the SAM, SECURITY or SYSTEM hives into files disguised with an evt extension under ProgramData, a credential access technique used by Play ransomware operators during a privilege escalation zero-day intrusion.

Malicious mshta Launching WScript VBScript Loader

This rule detects mshta.exe executing inline JavaScript that instantiates a WScript shell to run a VBScript payload, the initial execution chain used by Shuckworm to deploy GammaSteel from an infected removable drive.

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

This rule detects cmd.exe running a quiet command that redirects output to the local ADMIN share, the signature behavior of Impacket wmiexec and atexec used by China-linked actors for remote command execution during a US intrusion.

Suspicious Active Directory Snapshot Creation via ntdsutil

This rule detects ntdsutil.exe creating and mounting a snapshot, a technique used by espionage actors targeting Asian governments to extract the Active Directory database and steal domain credentials.

Suspicious BugSplat Binary Sideloading bugsplatrc.dll via DLL Search Order Hijack

This rule detects a renamed BugSplat executable loading a malicious bugsplatrc.dll from the same directory. This DLL sideloading pattern was used by China-linked actors in the ToolShell SharePoint intrusion to load ShadowPad.

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

This rule detects loading of a DLL named EndpointDlp.dll, which is Backdoor.Mistic masquerading as a Microsoft data loss prevention component. It is sideloaded through the legitimate MpExtMs.exe to gain covert execution.

Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll

This rule detects sentinelmemoryscanner.exe loading a sentinelagentcore.dll from its directory, a DLL sideloading pair abused by Seedworm to run the ChromElevator credential tool under the guise of a security product.

Suspicious Trend Micro Binary Sideloading tmdglog.dll

This rule detects the legitimate Trend Micro tmdbglog.exe loading a malicious tmdglog.dll from its directory. Billbug used this DLL sideloading chain to run the Sagerunex backdoor in Southeast Asian espionage intrusions.