Sigma detection rules, expert-reviewed

Suspicious Data Exfiltration via MEGAsync (via process_creation)

This rule detects execution of the MEGAsync client which was used to exfiltrate data during a LockBit 3.0 ransomware intrusion. MEGAsync is a legitimate cloud sync tool frequently abused for bulk data theft in double-extortion cases. Presence on a server or unexpected host suggests staged data leaving the environment before encryption.

Suspicious Domain Controller Discovery via nltest dclist (via process_creation)

This rule detects nltest being used with the dclist option to enumerate domain controllers, part of the chained reconnaissance run before LockBit 3.0 deployment. Attackers map the domain to plan lateral movement and privilege escalation. Domain controller discovery is an early staging action that precedes credential theft and domain-wide encryption.

Malicious Cobalt Strike Loader via rundll32 From ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData directory using the DllRegisterServer export, the Cobalt Strike loading pattern seen in a LockBit 3.0 intrusion. Legitimate DLLs are rarely staged in ProgramData and run this way. Proxying a beacon through a signed binary from a writable path enables stealthy command-and-control ahead of ransomware deployment.

Malicious rundll32 IternalJob Export Spawned by wscript (via process_creation)

This rule detects wscript.exe spawning rundll32.exe to call the IternalJob export, the execution chain used by the BumbleBee loader launched from a VBS script via a scheduled task. The misspelled IternalJob export name is a specific loader artifact. This chain proxies malicious code execution through a signed binary to load BumbleBee and stage follow-on payloads.

Suspicious File Download via certutil URLCache (via process_creation)

This rule detects certutil being used with the urlcache option to retrieve a remote file over HTTP, a living-off-the-land download technique used via a webshell to fetch a backdoor in a ShadowPad intrusion. certutil is not a legitimate file downloader in normal administration. Using a signed binary to pull payloads evades application controls and network monitoring.

Suspicious AnyDesk Unattended Password Set via Piped Echo

This rule detects an AnyDesk unattended-access password being configured by piping a value through echo into the --set-password parameter, a scripted technique used by threat actors to enable silent remote access without user interaction. Programmatic password provisioning to AnyDesk is a strong indicator of malicious remote-access setup.

Suspicious 7za Archiver Executed from Windows Temp

This rule detects the standalone 7za.exe archiver running from the Windows Temp directory, matching SnapMC staging where data is compressed for exfiltration using a dropped command-line archiver. Execution of an archive utility from Temp outside any install path is a common data-collection precursor to exfiltration.

Malicious Data Exfiltration via MinIO Client from Windows Temp

This rule detects execution of the MinIO client with a config directory placed under Windows Temp as vmware.x combined with the insecure recursive copy flags used by the SnapMC actor to exfiltrate stolen data to attacker object storage. The masqueraded config path with TLS verification disabled is a strong indicator of automated bulk exfiltration.

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

This rule detects discovery command output being redirected into the Qlik Sense web-served fonts directory using the qle.ttf or qle.woff filenames, a data-staging technique used by Cactus ransomware operators after exploiting Qlik Sense to make recon results retrievable over HTTP. Writing whoami or quser output into a webroot fonts path is a strong indicator of hands-on-keyboard exploitation.

Suspicious ADCS Certificate Abuse Tooling via Command Line (via process_creation)

This rule detects command lines invoking ADCS abuse tools such as Certipy or Certify performing certificate requests against templates. These tools exploit misconfigured certificate templates to obtain certificates for arbitrary or privileged identities. Certificate-based authentication material grants durable access and privilege escalation across the domain.

Suspicious Data Exfiltration to Backblaze B2 via rclone (via process_creation)

This rule detects rclone copying data to a Backblaze B2 remote which was used to stage stolen data prior to BitLocker ransomware deployment. rclone to cloud storage is a common double-extortion exfiltration channel. Bulk transfer of files to attacker-controlled cloud storage precedes extortion and public leak threats.

Malicious DCSync Credential Dumping Tooling via Command Line (via process_creation)

This rule detects command lines invoking known DCSync implementations such as the mimikatz lsadump dcsync module or impacket secretsdump. These tools request directory replication to extract account password hashes from a domain controller. Recovering domain hashes including krbtgt enables golden ticket forgery and full domain compromise.

Suspicious Direct etcd Database Access via etcdctl With Server Certificates (via process_creation)

This rule detects execution of etcdctl using the etcd server certificates and the local etcd endpoint to read or write cluster state directly. Post-exploitation of a compromised etcd in Kubernetes clusters abuses this path to bypass the kube-apiserver and its admission controls. Direct database access lets an attacker read secrets or inject resources with full control over the cluster.

Malicious Inbox Rule Hiding Security Mail to RSS Feeds via M365 (via m365)

This rule detects creation of an Exchange Online inbox rule that moves messages into the RSS Feeds folder and marks them as read. This is a common business email compromise technique to hide security notifications and replies from the compromised user. Concealing warning mail lets the attacker operate the mailbox and pursue fraud undetected.

Suspicious Kubernetes SelfSubjectAccessReview Permission Enumeration

This rule detects creation of SelfSubjectAccessReview or SelfSubjectRulesReview objects which are used to enumerate the permissions granted to the current identity as described in NCC Group Kubernetes detection engineering research. Adversaries query their own effective RBAC access to plan privilege escalation and lateral movement so bursts of these reviews should be investigated.