Sigma detection rules, expert-reviewed

Possible PetitPotam Coercion via IPC$ Named Pipe Access (via security)

This rule detects network share access in Event ID 5145 to the IPC$ share targeting sensitive RPC named pipes such as efsrpc and lsarpc used to coerce authentication. PetitPotam abuses the EFS RPC interface to force a host to authenticate to an attacker for NTLM relay. Coerced authentication relayed to ADCS or other services enables privilege escalation and domain takeover.

Possible Pass-the-Hash NTLM Network Logon (via security)

This rule detects network logons using the NTLM authentication package in Event ID 4624 with logon type 3, the pattern left behind by pass-the-hash lateral movement. Attackers reuse stolen NTLM hashes to authenticate to remote hosts without knowing the plaintext password. Hash reuse enables lateral movement and access to additional systems while blending with normal NTLM traffic.

Malicious APT15 Persistence via Nwsapagent Service or Run Key Registry Value

This rule detects registry modifications that register APT15 persistence under the Nwsapagent name in either a service key or an autorun Run key. Observed in NCC Group research on APT15 RoyalCli and RoyalDNS which persist via a Nwsapagent service and Run key. Masquerading persistence under a plausible service name is a hallmark of this espionage group.

Suspicious Winlogon Userinit Hijack for Persistence

This rule detects modification of the Winlogon Userinit value to a path other than the legitimate system userinit.exe, a logon persistence technique used by the Team9 malware family. Chaining an attacker binary into the Userinit key causes it to execute automatically during every interactive logon.

Malicious Team9 Persistence via BackUp Mgr Run Key

This rule detects creation of a Run key value named BackUp Mgr, a masquerading autostart entry used by the Team9 malware family to gain persistence at user logon. The benign-looking value name in an autorun location combined with a non-standard payload path is a strong indicator of Team9 persistence.

Possible SCOM RunAs Credential Theft via Access to Common MOMBins Encryption Key

This rule detects access to the System Center Operations Manager Common registry location holding the MOMBins encryption key used to protect stored RunAs credentials as described by NCC Group. Reading this key enables offline decryption of the SCOM credential store and recovery of privileged service account passwords.

Linux: System Shell Spawned by Celery Worker Python Process

Flags Linux instances where a Celery worker’s Python process spawns a system shell interpreter.

Malicious NetHealth Run Key Persistence

This rule detects creation of a NETHEALTH autorun value under the CurrentVersion Run key pointing to a NetHealth executable in AppData Roaming, the persistence mechanism used in the Rapid Breach intrusion to relaunch the implant at logon. A masqueraded health-monitor name running from a user profile path indicates malicious persistence.

Suspicious Weakening of Certificate Binding Enforcement via Registry (via registry_set)

This rule detects changes to the StrongCertificateBindingEnforcement or SCHANNEL CertificateMappingMethods registry values that govern how certificates map to Active Directory accounts. Downgrading these controls re-enables weak certificate mapping abused in ADCS impersonation attacks. Relaxed binding lets a forged or requested certificate authenticate as a privileged account.

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

This rule detects modification of the DisableRestrictedAdmin LSA registry value which controls Restricted Admin mode for RDP. Ransomware operators set this to enable pass-the-hash style lateral movement over RDP without supplying plaintext credentials. Weakening this control aids credential reuse and lateral movement across the estate before encryption.

Suspicious Rogue Machine Account Creation via Powermad New-MachineAccount

This rule detects use of the Powermad New-MachineAccount cmdlet to create a rogue computer account in Active Directory, the first step of a resource-based constrained delegation attack that leads to privilege escalation. Creation of attacker-controlled machine accounts through this tooling is a strong indicator of an RBCD abuse chain.

Possible FluBot C2 Polling via Known Malware URI Paths

This rule detects HTTP requests to the short polling endpoints used by the FluBot Android banking malware to reach its command-and-control server. Repeated beaconing to these fixed URI paths indicates an infected device polling for tasks and reporting stolen data.

Malicious Dropbox Cloud C2 via Spoofed Googlebot User Agent

This rule detects web traffic to the Dropbox content API using a spoofed Googlebot user agent which the RokRat implant used for command and control as analysed by NCC Group. Abusing a legitimate cloud storage API with a crawler user agent lets the malware blend exfiltration and tasking into normal web traffic.

Suspicious Hydra Android Banking Trojan C2 Mirror List Retrieval via Proxy

This rule detects HTTP requests to the Hydra Android banking trojan command-and-control mirror-list endpoint which returns a base64-encoded JSON list of fallback C2 servers. Observed in NCC Group Threat Spotlight research on Hydra which retrieves mirror lists over HTTP as well as from onion and code-hosting services. Identifying this retrieval helps surface infected mobile devices reaching out for updated C2 infrastructure.

Malicious MetaStealer C2 via cpp-httplib User-Agent (via proxy)

This rule detects outbound web requests presenting the cpp-httplib user-agent to the MetaStealer tasking endpoints such as api/client/new and tasks/get_worker. The combination of the library user-agent and these fixed URIs is a specific C2 fingerprint. Matching it surfaces hosts beaconing to MetaStealer infrastructure to register and receive stealer tasks.