Sigma detection rules, expert-reviewed

Possible Shellshock Bash Function Definition Injection via Process Creation

This rule detects the Shellshock (CVE-2014-6271) exploitation pattern where an attacker injects a Bash environment-variable function definition prefix into a command line. Captured in NCC Group research on the Shellshock Bash vulnerability targeting CGI endpoints. Exploiting this flaw yields unauthenticated remote code execution which makes early detection of the injection prefix important.

Possible Driver Enumeration via Driverquery for Rootkit Discovery

This rule detects execution of the driverquery utility used to enumerate installed kernel drivers. NCC Group observed this discovery step around deployment of the malicious netfilter driver. While the tool is legitimate its use in interactive attacker sessions can indicate reconnaissance for driver based persistence.

Suspicious Svchost Masquerade Execution from Non-System Path

This rule detects a process named svchost.exe running from a directory outside the Windows System32 or SysWOW64 folders. NCC Group observed the Rclone exfiltration binary renamed to svchost.exe to blend in with legitimate host processes. Attackers rename tooling to trusted system binary names to evade analyst review and simple name based defenses.

Suspicious Rclone Cloud Sync Execution for Data Exfiltration via Command Line

This rule detects execution of the Rclone command-line tool with cloud remote sync subcommands used to stage and copy local data to attacker controlled storage. It aligns with NCC Group observations of Rclone abused to exfiltrate data to MEGA cloud storage. Adversaries use Rclone to move large volumes of stolen data out of a network prior to extortion.

Malicious S4U Ticket Request via Impacket getST

This rule detects execution of the Impacket getST tool with impersonation options used to perform S4U2Self and S4U2Proxy requests, the ticket-forging step that abuses resource-based constrained delegation to impersonate a privileged user. Use of this tooling indicates active exploitation for lateral movement and privilege escalation.

Suspicious Hidden Scheduled Task EventLogBackupTask Creation

This rule detects creation of a scheduled task named EventLogBackupTask with a logon trigger, a persistence artifact used in the Rapid Breach intrusion where a benign-sounding task name masks a logon-triggered implant. Creation of this specifically named task via schtasks is a strong indicator of attacker persistence.

Malicious PowerShell Download Cradle Spawned by Quick Assist

This rule detects Quick Assist spawning PowerShell that uses an IEX DownloadString cradle to fetch and execute remote code, the initial-access chain seen when a social-engineering operator drives the victim through Quick Assist to run attacker payloads. A remote-support tool launching an in-memory download cradle is a strong indicator of a tech-support scam intrusion.

Malicious Recovery Disablement via Bcdedit RecoveryEnabled No

This rule detects bcdedit.exe disabling Windows automatic recovery by setting recoveryenabled to no, an inhibit-system-recovery action performed by SafePay and many ransomware families before encryption. Disabling boot recovery has almost no legitimate administrative use on production hosts and indicates preparation for impact.

Suspicious Regsvr32 Execution of SafePay Loader DLL

This rule detects regsvr32.exe being used to execute the soc.dll loader observed in SafePay ransomware intrusions, a signed-binary-proxy technique to run malicious code while evading application controls. Regsvr32 loading a payload DLL named soc.dll is a strong indicator of the SafePay staging chain.

Malicious SafePay Ransomware Encryptor Command-Line Execution

This rule detects the SafePay ransomware encryptor invoked with its characteristic password, encryption and self-delete parameters used to encrypt targeted paths and remove the binary afterward. This combination of flags is unique to the SafePay payload and indicates active data-encryption impact.

Malicious Scheduled Task Persistence for Lazarus VPN Loader (via process_creation)

This rule detects creation of a scheduled task named Windows Java Vpn Interface via schtasks, used by Lazarus to persist the rundll32 loader with a daily trigger. The masqueraded task name mimics a legitimate VPN component. Establishing a scheduled task ensures the implant re-launches to maintain access for follow-on espionage activity.

Malicious rundll32 Execution of Lazarus JavaPackage DLL (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData Oracle Java path via the VpnUserInterface export, the loader used in a Lazarus social engineering initial access chain. The masqueraded Java path combined with the VpnUserInterface export is a specific implant artifact. This proxies malicious code through a signed binary to establish a foothold for follow-on tasking.

Malicious Defender Exclusion Added via Add-MpPreference (via process_creation)

This rule detects use of the Add-MpPreference cmdlet to add a Microsoft Defender exclusion, observed as MetaStealer excluded executable files from scanning. Adding exclusions blinds the antivirus to malicious binaries in the excluded scope. This defence evasion clears the way for the infostealer to run and persist without detection.

Suspicious Data Exfiltration via MEGAsync (via process_creation)

This rule detects execution of the MEGAsync client which was used to exfiltrate data during a LockBit 3.0 ransomware intrusion. MEGAsync is a legitimate cloud sync tool frequently abused for bulk data theft in double-extortion cases. Presence on a server or unexpected host suggests staged data leaving the environment before encryption.

Suspicious Domain Controller Discovery via nltest dclist (via process_creation)

This rule detects nltest being used with the dclist option to enumerate domain controllers, part of the chained reconnaissance run before LockBit 3.0 deployment. Attackers map the domain to plan lateral movement and privilege escalation. Domain controller discovery is an early staging action that precedes credential theft and domain-wide encryption.