Sigma detection rules, expert-reviewed

Suspicious Windows Service Masquerading as Windows Defend by APT41 (via registry_set)

This rule detects creation of a Windows service registry key named Windows Defend, a deliberate misspelling of Windows Defender used by APT41 to blend malicious persistence with legitimate security tooling. Services impersonating security products are a defense evasion technique that grants persistent SYSTEM execution.

Malicious UNC1549 OneDrive-Masquerading Run Key Persistence (via registry_set)

This rule detects Run key values named to impersonate OneDrive components such as OneDriveFileCoAuth or OneDriveCoUpdate. UNC1549 planted these autorun entries to relaunch MINIBIKE side-loading at logon while blending with genuine OneDrive tasks. A Run value borrowing the OneDrive brand for a non-standard executable path is a persistence and masquerading indicator.

Suspicious Salesforce Data Access via Spoofed Automation User-Agents

This rule detects Salesforce API traffic carrying the distinctive spoofed user-agent strings Salesforce-Multi-Org-Fetcher/1.0 or python-requests used by UNC6395 after stealing Drift OAuth tokens. These clients drove SOQL enumeration and bulk extraction of User and Case records, indicating automated mass data theft rather than normal integration traffic.

Suspicious GCP Metadata Service Token Access via Command Line (via process_creation)

This rule detects a command line that queries the GCP metadata service compute endpoint for a service account access token, the action used to steal cloud credentials after achieving code execution in an exposed Cloud Function. Adversaries harvest the default service account token to pivot into the wider cloud project, so metadata token retrieval from a runtime process is a high-value credential access indicator.

Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)

This rule detects a switch-user operation targeting the troot account, the uid 0 backdoor account injected into /etc/passwd and /etc/shadow during exploitation of Cisco Catalyst SD-WAN Manager. Adversaries create and then assume this masqueraded root-equivalent account to maintain privileged access, so an su to troot is a strong sign of post-exploitation activity.

Malicious Cisco SD-WAN Tenant List Upload Script Execution (via process_creation)

This rule detects execution of the vconfd_script_upload_tenant_list.sh helper script recorded during exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245), where the crafted tenant CSV was processed to append a rogue root account to system files. Adversaries trigger this internal script as part of the privilege escalation chain, so its appearance in logs indicates the vulnerability was exercised.

Possible Cisco Catalyst SD-WAN Manager Tenant Upload Exploitation CVE-2026-20245 (via process_creation)

This rule detects the tenant-upload tenant-list request pattern used to exploit CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, where a crafted tenant CSV was uploaded to inject a privileged account into the appliance. Adversaries leverage this zero-day to gain root-level control of the management plane, so this request signature is a high-value indicator of active exploitation.

Suspicious ESXi execInstalledOnly Disabled via esxcli During Ransomware

This rule detects esxcli disabling the execInstalledOnly enforcement setting on an ESXi host which ransomware crews do to allow unsigned binaries to run before encrypting virtual machines. Attackers weaken hypervisor integrity controls to deploy their locker at scale.

Malicious Defender Tampering via Registry DisableRealtimeMonitoring

This rule detects reg.exe writing the DisableRealtimeMonitoring or DisableAntiSpyware values to disable Microsoft Defender protections as commonly seen in ransomware pre encryption staging. Attackers turn off real time scanning so their tooling and payloads can run undetected.

Suspicious Deletion of Terminal Server Client History via reg by UNC1549

This rule detects reg.exe deleting the Terminal Server Client history keys that store previously connected RDP hosts as observed in UNC1549 anti forensic activity. Attackers remove these keys to hide lateral movement targets from responders.

Suspicious Child Process Spawned by Triofox GladinetCloudMonitor

This rule detects the Triofox GladinetCloudMonitor process spawning a command interpreter which follows exploitation of CVE-2025-12480. Attackers abuse the built in anti virus feature to execute attacker controlled batch and PowerShell commands as SYSTEM.

Suspicious Scheduled Task Running pythonw From AppData via COLDRIVER

This rule detects creation of a scheduled task that launches pythonw.exe from a Python38-64 directory under AppData as used by COLDRIVER to persist a health check backdoor. Attackers use this to maintain a stealthy Python based foothold masquerading as a system maintenance job.

Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix

This rule detects mshta.exe spawning powershell.exe as observed in UNC5142 EtherHiding campaigns where an HTA disguised as an XLL launches an in-memory VIDAR or LUMMAC.V2 loader. Attackers abuse this chain to execute stager code from a fake browser update lure while evading disk based detection.

Malicious Reverse Shell Spawned from Oracle EBS Java Process

This rule detects an interactive bash reverse shell to /dev/tcp launched by a Java process running as the applmgr account, matching post-exploitation of the Oracle E-Business Suite zero-day. This gives the extortion actor command execution on the application server to stage the GOLDVEIN.JAVA C2 and exfiltrate data.

Malicious ESX Admins Group Creation via WinRM Host

This rule detects the WinRM provider host wsmprovhost.exe launching net.exe to create or modify a group named ESX Admins, matching the UNC3944 technique that abuses a default vSphere Active Directory integration to grant full administrative rights over the ESXi estate. This privilege escalation precedes VM theft and hypervisor-level ransomware.