Sigma detection rules, expert-reviewed

Malicious ESX Admins Group Creation via WinRM Host

This rule detects the WinRM provider host wsmprovhost.exe launching net.exe to create or modify a group named ESX Admins, matching the UNC3944 technique that abuses a default vSphere Active Directory integration to grant full administrative rights over the ESXi estate. This privilege escalation precedes VM theft and hypervisor-level ransomware.

Malicious Bash Reverse Shell via /dev/tcp

This rule detects an interactive bash session redirecting its input and output to a /dev/tcp socket, matching the OVERSTEP dobackshell command that opens a reverse shell from a compromised SonicWall SMA appliance. This gives the operator hands-on-keyboard control to stage data theft and additional persistence.

Malicious Rundll32 Execution of Image File Export via PLUSDROP

This rule detects rundll32.exe invoking an export from a file with an image extension staged in an image subfolder, matching the APT41 PLUSDROP loader launched from a malicious LNK to run the TOUGHPROGRESS chain. Attackers disguise the payload as a JPG to bypass extension-based inspection while executing an exported function.

Malicious Sed Tampering of Ivanti Debug and Audit Logs (via process_creation)

This rule detects sed being used to edit the Ivanti Connect Secure debuglog and audit.log files in place, the selective log tampering technique used during zero-day exploitation to remove evidence of PHASEJAM web shell activity. In-place editing of appliance logs indicates indicator removal by an intruder.

Malicious CivilDefense Loader Spawning civildefensestarter Payload (via process_creation)

This rule detects the CivilDefense lure executable spawning civildefensestarter.exe, the Pronsis Loader chain used in a Russia-aligned campaign to stage PURESTEALER against Ukrainian military recruits. The parent-child masquerade using civil defense themed filenames indicates second-stage loader execution.

Suspicious Scheduled Task Named Sumatra Launcher by UNC2970 (via process_creation)

This rule detects creation of a scheduled task named Sumatra Launcher, the persistence mechanism UNC2970 registered to run the BURNBOOK loader daily at logon after delivering a trojanized SumatraPDF reader. A logon-triggered task masquerading as a PDF viewer helper indicates backdoor persistence.

Malicious IIS Worker Process Spawning conn.exe Web Shell Child by APT41 (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning a masqueraded conn.exe child process, a pattern consistent with APT41 web shell command execution on compromised web servers. A web server process launching arbitrary tooling is a strong indicator of an installed web shell.

Malicious CrowdStrike Falcon RTR Abuse Downloading From fleetdeck.io by UNC3944 (via process_creation)

This rule detects curl commands reaching the remote management tooling endpoints fleetdeck.io or the external IP echo service icanhazip.com, which UNC3944 executed through abused CrowdStrike Falcon Real Time Response runscript access to stage remote access software. Attacker abuse of a trusted EDR RTR channel to deploy tooling is a strong indicator of hands-on-keyboard intrusion.

Malicious Rogue F5 BIG-IP Administrator Account Creation via tmsh (via process_creation)

This rule detects the F5 tmsh utility creating an authentication user with an administrator role. Initial access brokers exploiting F5 BIG-IP CVE-2023-46747 provisioned a rogue admin account to lock in privileged appliance control. Creation of a new admin-role user on a network appliance is a strong persistence and account-manipulation indicator.

Malicious Python Reverse Shell One-Liner Execution (via process_creation)

This rule detects Python invoked with an inline -c one-liner that opens a socket and duplicates its file descriptors onto a shell, the hallmark of a reverse shell. Actors targeting Ivanti Connect Secure used Python reverse shells for interactive access after exploitation. Inline socket-to-shell Python is a high-confidence remote-access indicator.

Malicious Ivanti Log Clearing via logClear Perl Script (via process_creation)

This rule detects execution of a logClear Perl utility used to selectively remove appliance log entries on compromised Ivanti Connect Secure devices. The actor ran this tooling to delete Integrity Checker and system events tied to their intrusion, frustrating forensic review. Purpose-built log-clearing tooling on an appliance is a clear indicator-removal action.

Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)

This rule detects the mknod utility being used to create files within the /boot/os_tools/ directory on Linux-based appliances. UNC4841 staged dropper components in this boot-partition path to survive appliance updates and reboots on compromised Barracuda ESG devices. Writing executable content into the boot partition is highly abnormal and indicates deliberate low-level persistence.

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Suspicious CANONSTAGER DLL Side-Loading via cnmpaui Executable

This rule detects the legitimate Canon utility cnmpaui.exe loading a DLL from a user-writable directory outside its normal Program Files location, matching the PRC-Nexus CANONSTAGER side-loading that launches the SOGU.SEC backdoor. Abusing a signed printer binary lets the actor execute malicious code under a trusted process during espionage against diplomats.

Malicious APT29 WINELOADER DLL Side-Load of vcruntime140.dll via SqlDumper (via image_load)

This rule detects the Microsoft SqlDumper.exe binary loading a vcruntime140.dll from a non-standard directory, the side-load chain APT29 used to run the WINELOADER backdoor. The actor paired a legitimate signed executable with a malicious runtime DLL to gain trusted execution. SqlDumper loading vcruntime140.dll outside canonical install paths is a high-fidelity side-loading indicator.