Sigma detection rules, expert-reviewed

Possible Malicious MCP Server Credential Exfiltration via DevTools-Assistant Agent (via proxy)

This rule detects outbound HTTP requests carrying the DevTools-Assistant user agent or destined for the api.github-analytics.com host used by the trojanized MCP server to exfiltrate stolen developer credentials. The custom user agent string and attacker controlled domain are distinctive network markers of this supply-chain compromise. Such traffic represents active data theft from a developer workstation.

Suspicious StupidSandwichAgent User-Agent in C2 Traffic by StaryDobry

This rule detects outbound HTTP requests carrying the hardcoded StupidSandwichAgent User-Agent string used by the StaryDobry campaign loader. This unusual and unique agent value identifies command-and-control and payload retrieval traffic from the miner dropper. Presence of this User-Agent indicates StaryDobry C2 communication.

Suspicious MSSQL xp_cmdshell Enablement via sp_configure (via process_creation)

This rule detects command lines that enable the MSSQL xp_cmdshell feature through sp_configure, a preparatory step used in the printer-and-BitLocker extortion scheme to unlock operating system command execution from the database. Enabling xp_cmdshell is a strong indicator of an attacker preparing to run OS commands via a compromised SQL server.

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

This rule detects 7-Zip creating a password protected archive using the hardcoded password embedded in the GoSerpent backdoor tooling. The specific static password uniquely identifies the actor collection and exfiltration staging. Password protected archiving with this constant is a high-confidence collection indicator.

Suspicious Command Shell Spawned by lmadmin License Manager via process_creation

This rule detects the lmadmin.exe license manager spawning a command shell or PowerShell, indicating post-exploitation of the Schneider Electric vulnerability including SeImpersonate Potato style privilege escalation. The license service has no legitimate need to launch interactive shells. A shell child under lmadmin points to exploitation and follow-on execution.

Malicious LSASS Memory Dump via procdump

This rule detects procdump creating a full memory dump of the lsass.exe process to harvest credentials, as performed in the StrikeShark campaign. Dumping LSASS memory yields plaintext and hashed credentials for lateral movement. This is a strong credential-access indicator even though procdump is a legitimate Sysinternals tool.

Malicious NTDS Extraction via ntdsutil IFM

This rule detects ntdsutil creating an Install From Media snapshot to extract the Active Directory database. The StrikeShark Cobalt Strike campaign uses this to steal domain credentials from a domain controller. NTDS extraction through ntdsutil is a high-confidence credential-access indicator.

Suspicious wermgr Execution Outside System Directories via process_creation

This rule detects the Windows Error Reporting Manager wermgr.exe running from a path outside System32 and SysWOW64. The MiniPlasma exploitation chain launches a masqueraded wermgr.exe from an unexpected location. A trusted system binary name executing from the wrong directory indicates masquerading and likely process injection.

Malicious Cloud Atlas PowerShower Execution via googleearth Script (via process_creation)

This rule detects PowerShell executing a script named googleearth.ps1, the masqueraded PowerShower component Cloud Atlas deploys to run reconnaissance and staging logic. The benign looking script name conceals malicious PowerShell activity. Detecting this invocation surfaces execution of the group tooling on the host.

Malicious Cloud Atlas UAC Bypass via fodhelper (via process_creation)

This rule detects fodhelper.exe spawning a command interpreter or scripting host, the child processes produced by the fodhelper registry hijack that Cloud Atlas uses to bypass User Account Control. The bypass grants elevated execution without a consent prompt. Detecting fodhelper as the parent of these processes surfaces privilege escalation attempts.

Malicious Kimsuky Scheduled Task Persistence via ChromeCheck and EdgeCheck (via process_creation)

This rule detects schtasks.exe creating a minute interval task named ChromeCheck or EdgeCheck, browser themed names Kimsuky uses to disguise persistence for its PebbleDash based tooling. The frequent task keeps the implant resident and blends with browser maintenance. Detecting these task names surfaces persistence tied to the campaign.

Malicious DAEMON Tools Backdoor Execution via rundll32 mcrypto (via process_creation)

This rule detects rundll32.exe executing an export of the mcrypto module used by the DAEMON Tools supply chain backdoor to run and clean up its payload. The distinctive misspelled chiper export marks the malicious loader invocation. Detecting this command surfaces proxied backdoor execution on the host.

Malicious DAEMON Tools Supply Chain Payload Download via PowerShell WebClient (via process_creation)

This rule detects PowerShell using a WebClient DownloadFile call to stage a payload into the Windows Temp directory, an action tied to the DAEMON Tools supply chain compromise. The download retrieves second stage backdoor components after a trojanized installer runs. Detecting the download to Temp surfaces the payload staging step of the intrusion.

Malicious Silver Fox PowerShell Download Cradle via irm and iex (via process_creation)

This rule detects PowerShell combining Invoke-RestMethod with Invoke-Expression to download and directly execute remote content, the delivery cradle used by the Silver Fox ABCDoor campaign. The technique retrieves and runs backdoor code in memory following a tax themed phishing lure. Detecting the irm to iex pattern surfaces staged payload execution.

Malicious Lotus Wiper Masqueraded Binary Execution from lotus Directory (via process_creation)

This rule detects execution of the masqueraded binaries nstats.exe or nevent.exe from a lotus directory used by the Lotus Wiper to blend destructive tooling with benign looking names. The false name in an anomalous path signals staged wiper components. Detecting this execution surfaces the wiper toolset on disk.