Sigma detection rules, expert-reviewed

Suspicious Cloud Exfiltration via Rclone

This rule detects execution of the rclone cloud sync utility with copy or sync operations, a data-exfiltration technique used by the Karakurt extortion actor to push staged files to attacker-controlled cloud storage. Bulk transfer of internal data to an external cloud provider is a strong sign of exfiltration ahead of extortion.

Malicious Kubernetes Node Escape via chroot to Node kubectl Path

This rule detects a chroot into the node-local kubectl directory used on managed Kubernetes nodes, a container-to-node escape technique observed in real-world cluster attacks after landing in a privileged pod. Breaking out to the node host filesystem gives the attacker control over the worker node and any credentials stored on it.

Possible Kubernetes Service Account Token Theft from Pod Secrets Path

This rule detects a process referencing the in-pod service-account secrets directory where Kubernetes mounts the projected token, ca certificate and namespace, a credential-access step observed in real-world cluster attacks. Reading this token lets an attacker authenticate to the Kubernetes API as the pod identity and expand access across the cluster.

Suspicious Kubernetes Pod Deployment with Privileged or Host Namespace Flags

This rule detects on-the-fly creation of Kubernetes pods running tooling such as busybox or socat with privileged, host-PID or host-path options, a container-escape and pivot technique seen in real-world cluster attacks. Launching a privileged pod that mounts the node filesystem lets an attacker break out of the container onto the underlying host.

Suspicious Kubernetes Permission Enumeration via kubectl auth can-i

This rule detects use of kubectl to enumerate the caller permissions in a cluster by listing all allowed actions, a post-compromise reconnaissance step observed in real-world Kubernetes intrusions after remote code execution in a pod. Attackers use this to map the reach of a stolen service-account token before attempting privilege escalation or lateral movement.

Suspicious Silent Security Product Uninstaller Execution

This rule detects an Inno Setup product uninstaller being launched with fully silent flags, a behavior observed in LemonDuck first-stage payloads that silently remove Malwarebytes and other security products via their unins000.exe with /verysilent. Running an uninstaller with no user interaction is a strong indicator of automated defense removal by malware.

Malicious Antivirus Removal via WMIC Product Uninstall

This rule detects abuse of wmic.exe to enumerate installed products through the product class and invoke their uninstall method non-interactively, a technique used by LemonDuck first-stage payloads to silently remove antivirus and endpoint protection. Stripping defensive software before the next stage runs weakens host protections and lets the attacker operate undetected.

Suspicious Domain Computer Enumeration via Net Group Command

This rule detects enumeration of domain computer accounts via the net group domain computers command which the RM3 banking malware used for network discovery as documented by NCC Group. Adversaries enumerate domain assets to plan lateral movement and identify high value targets.

Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host

This rule detects the Windows script host executing a VBScript from a non standard ProgramLogs directory used in the Lazarus shellcode execution chain analysed by NCC Group. Placement of scripts in an atypical top level folder is a masquerading and staging technique preceding shellcode injection.

Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse

This rule detects the Cisco AnyConnect agent or downloader spawning a Windows script host to run OnConnect or OnDisconnect scripts which NCC Group showed can be abused to drop and execute attacker payloads on VPN connect events. Abusing the trusted VPN client for script execution evades application allow lists and provides connection triggered persistence.

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

This rule detects use of fsutil to delete the NTFS USN change journal which NotPetya performed to destroy filesystem forensic evidence as documented by NCC Group. Deletion of the change journal removes records of file activity and is rarely part of legitimate administration.

Suspicious Scheduled Task Creation for System Reboot via Schtasks

This rule detects creation of a scheduled task that invokes shutdown with a forced restart which NotPetya used to reboot hosts into its encryption phase as reported by NCC Group. A scheduled forced reboot combined with disk tampering is a hallmark of destructive ransomware execution.

Suspicious Windows Event Log Clearing via wevtutil

This rule detects use of wevtutil to clear Windows event logs which ransomware operators use to destroy forensic evidence during an intrusion. Observed in NCC Group research into active ransomware families. Clearing event logs is a defense-evasion and anti-forensic behavior that rarely occurs in normal administration.

Suspicious Credential String Enumeration via findstr to Temp Directory

This rule detects use of findstr to search files for password strings with output directed into the Windows Temp directory which Lorenz ransomware uses to harvest credentials from local files. Observed in NCC Group research unmasking Lorenz ransomware. Bulk searching for password keywords is a hands-on-keyboard credential-access behavior worth surfacing.

Suspicious Scheduled Task Masquerading as Google Chrome Updates via Process Creation

This rule detects creation of a scheduled task named to impersonate a Google Chrome update mechanism which Lorenz ransomware uses for persistence. Observed in NCC Group research unmasking Lorenz ransomware tactics techniques and procedures. Attackers disguise persistence as a benign updater which makes this named-task masquerade a useful detection point.