Sigma detection rules, expert-reviewed

Malicious GigaWiper Ransomware File Extension .candy

This rule detects creation of files with the .candy extension, the marker appended to encrypted files by the GigaWiper destructive backdoor. A burst of files gaining this extension indicates active data destruction and encryption in progress across the host.

Malicious Linux systemd Persistence nvmconf.service

This rule detects creation of a systemd unit named nvmconf.service, the Linux persistence installed by the Mastra npm supply chain compromise. The service masquerades as Node version manager configuration to relaunch the malicious payload across reboots.

Malicious Sapphire Sleet LaunchDaemon Masquerading as Google WebKit Service (via file_event)

This rule detects creation of a LaunchDaemon property list named com.google.webkit.service.plist, a persistence artifact Sapphire Sleet plants on macOS while masquerading as a legitimate Google WebKit service. Adversaries install this daemon to survive reboots and maintain access after the initial lure compromise, so the appearance of this spoofed daemon name is a high-confidence sign of the implant.

Malicious Marbled Dust OMServerService VBScript Dropped to Startup Folder

This rule detects the creation of OMServerService.vbs inside the Start Menu Startup folder. Microsoft observed the Marbled Dust actor abusing an Output Messenger zero-day to drop this file via path traversal for persistence. Placing a VBScript in the Startup folder guarantees execution at logon, so this file event strongly indicates the espionage intrusion.

Suspicious Web Shell ASPX File Created in Exchange OWA Auth or SharePoint LAYOUTS Path (via file_event)

This rule detects creation of web-shell ASPX files named getidtoken.aspx or signout.aspx within Exchange OWA authentication, aspnet_client, or SharePoint LAYOUTS directories, the persistence artifacts dropped in attacks against on-premises Exchange and SharePoint servers. Adversaries place shells with authentication-themed names in trusted server paths to blend in and retain access, so these files appearing in those locations indicate web-shell installation.

Suspicious CLFS Base Log File Created in SkyPDF ProgramData Path during Zero-Day Exploitation (via file_event)

This rule detects creation of the CLFS base log file PDUDrv.blf under a SkyPDF ProgramData directory, the on-disk artifact of the Common Log File System zero-day exploitation that precedes privilege escalation and ransomware deployment. Adversaries craft a malicious .blf to trigger the CLFS vulnerability, so this specific file path appearing on a host is a strong indicator of exploitation.

Suspicious Azure Tenant Root Elevation via elevateAccess

This rule detects the Microsoft.Authorization elevateAccess action that grants a Global Administrator root access over all Azure subscriptions. Microsoft observed Storm-0501 abusing this to seize control of the cloud estate before ransomware impact. Tenant-wide elevation is a rare, high-privilege operation, so this action should be verified against expected administrative change.

Malicious Oracle EBS Exploitation via SyncServlet and TemplatePreviewPG

This rule detects web requests to the Oracle E-Business Suite /OA_HTML/SyncServlet and TemplatePreviewPG endpoints carrying the TMP or DEF template codes abused in CVE-2025-61882 exploitation. This request pattern drives injection of a malicious XSL template that leads to remote code execution in the widespread extortion campaign.

Suspicious vCenter VAMI SSH Enable via appliance access API

This rule detects an HTTP PUT to the vCenter VAMI endpoint /rest/appliance/access/ssh on management port 5480, matching BRICKSTORM activity that re-enables SSH on the appliance to gain shell access. Turning on this remote-access channel supports stealthy lateral movement and backdoor deployment across the virtualization estate.

Malicious WIREFIRE Webshell Access on Ivanti Connect Secure API Path (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/cav/client/visits endpoint that WIREFIRE trojanizes into a webshell. Suspected APT actors modified this component to accept encrypted commands and payloads through crafted requests to that URI. Traffic to this specific tampered API path signals interaction with the WIREFIRE backdoor.

Malicious ESX Admins Group Added to Privileged Directory Group

This rule detects an Active Directory security event adding an ESX Admins group or member, matching the UNC3944 method of creating that specific group name to inherit administrative access to vSphere through its default AD integration. The distinctive group name indicates targeting of the virtualization estate rather than routine administration.

Malicious STOCKSTAY Registry Run Key Persistence via MARKETMAKER Binaries (via registry_set)

This rule detects Registry Run key persistence whose value points to the StockMarketView, SMNet, or SMEditor executables used by Turla's MARKETMAKER loader in the STOCKSTAY intelligence gathering activity. Adversaries register these binaries under benign-looking run values to relaunch their toolset at logon, so this persistence entry is a reliable indicator of the campaign.

Suspicious Registry Run Key Persistence Masquerading as CanonPrinter

This rule detects creation of a Run key value named CanonPrinter, matching SOGU.SEC persistence that hides behind a Canon printer software name to relaunch the backdoor at logon. This trusted-name autorun entry maintains PRC-Nexus access to targeted diplomatic hosts across reboots.

Suspicious Registry Run Key Persistence Masquerading as Dropbox

This rule detects creation of an HKCU Run key value named Dropbox that points to an executable outside the legitimate Dropbox installation directory, matching STARKVEIL and FROSTRIFT persistence that hides behind a trusted application name. This false-context autorun entry survives reboot and relaunches the backdoor at logon.

Suspicious Windows Service Masquerading as Windows Defend by APT41 (via registry_set)

This rule detects creation of a Windows service registry key named Windows Defend, a deliberate misspelling of Windows Defender used by APT41 to blend malicious persistence with legitimate security tooling. Services impersonating security products are a defense evasion technique that grants persistent SYSTEM execution.