Sigma detection rules, expert-reviewed

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

This rule detects outbound web requests to index.php carrying the fixed authorization=1 query parameter used by the DGA based command-and-control of the pirated-media miner campaign. The constant URI structure across randomized domains is a reliable protocol fingerprint. Catching the beacon URI reveals active C2 traffic that domain blocklists miss.

Suspicious Storm-2561 Fake Pulse VPN Persistence via RunOnce Key (via registry_set)

This rule detects a RunOnce registry value configured to launch Pulse.exe, the persistence mechanism used by Storm-2561 after SEO-poisoned downloads deliver a fake Pulse Secure VPN installer. Adversaries use this autorun entry to relaunch the credential-stealing loader, so a RunOnce value pointing at Pulse.exe outside a genuine Pulse Secure deployment indicates the fake VPN foothold.

Malicious Microsoft Defender Tamper via Registry Modification

This rule detects registry modifications that disable Microsoft Defender protections under the Windows Defender policy keys. Attackers set DisableAntiSpyware or DisableRealtimeMonitoring to switch off protection persistently, a registry-based evasion technique covered in Sekoia detection engineering.

Malicious WeaXor Ransomware Encryption Artifacts on Disk (via file_event)

This rule detects file system artifacts left by WeaXor ransomware, namely files renamed with the wex extension and the dropped RECOVERY INFO note. It indicates active encryption on the host.

Suspicious DotNet Utility Spawned by Script Host for Hollowing (via process_creation)

This rule detects RegAsm, MSBuild, or AddInProcess32 launched by a script host or mshta. This layered loader spawns these signed .NET utilities as process hollowing targets for its final payload.

Malicious Windows Defender Exclusion for Windows Dell Folder

This rule detects Add-MpPreference adding a Defender exclusion path for a Dell folder under the Windows directory, a Prometei defense-evasion step. The botnet staged modules such as its Mimikatz variant in C:\Windows\Dell and excluded that path from Defender scanning. A Defender exclusion for a non-standard folder inside the Windows directory strongly indicates malware hiding its working directory.

Malicious RDP Session Hijacking via tscon Command Line

This rule detects execution of the native tscon.exe binary with a destination session and an rdp-tcp or console source argument, the living-off-the-land technique used to hijack another user's Remote Desktop session without their credentials. Adversaries with SYSTEM privileges connect an existing session to their own to inherit the victim's access for lateral movement and privilege escalation. Interactive tscon usage targeting another session is rarely legitimate.

Malicious Curl Download From C2 CAPTCHA Path via Process Creation

This rule detects curl.exe retrieving a payload using the misspelled /capcha URL path pattern used by the KongTuke fake-CAPTCHA campaign documented by Cisco Talos. The tool is invoked by a PowerShell downloader to pull the next stage from hardcoded command-and-control infrastructure. Detecting it identifies active second-stage retrieval over an attacker-controlled channel.

Suspicious Group Discovery - PowerShell (via powershell)

This rule detects enumerate local or domain groups via PowerShell.

Suspicious PowerShell History Logging Disabled via PSReadLine (via process_creation)

This rule detects PSReadLine being configured to save no command history via Set-PSReadLineOption with SaveNothing, a defense-evasion action observed with the TinyTurla-NG backdoor. Disabling history persistence removes a valuable forensic record of attacker PowerShell activity.

Malicious Impacket SMBexec Service Registration - Native (via security)

This rule detects register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

This rule detects OAuth application permission grants for high privilege mailbox scopes such as full_access_as_app EWS.AccessAsUser.All and ApplicationImpersonation. Midnight Blizzard granted these permissions to attacker-controlled applications to access mailboxes across the tenant.

Suspicious Creation of PowerShell Profile Script for Persistence

This rule detects creation or modification of a PowerShell profile script. Backdoors abuse the automatic execution of the profile file on every PowerShell launch to gain stealthy persistence, running an obfuscated loader each time a session starts.

Possible React Server Components Exploitation via Next-Action Header

This rule detects inbound web requests carrying a Next-Action server action header together with crafted action parameter markers, the request shape used to trigger CVE-2025-55182 in React Server Components. Exploitation abuses the server action deserialization path to reach arbitrary command execution. Requests bearing this header alongside the action index syntax against a Next.js application warrant investigation for RCE attempts.

Malicious PPL Abuse via ClipUp Protected Process Launch

This rule detects the ClipUp.exe utility launched with a protected process light argument, the technique RONINGLOADER uses to spawn a signed binary as a PPL and disable Microsoft Defender. Abusing ClipUp to obtain a protected process lets the loader tamper with security services that normally block it.