Sigma detection rules, expert-reviewed

Malicious DCSync Credential Dumping Tooling via Command Line (via process_creation)

This rule detects command lines invoking known DCSync implementations such as the mimikatz lsadump dcsync module or impacket secretsdump. These tools request directory replication to extract account password hashes from a domain controller. Recovering domain hashes including krbtgt enables golden ticket forgery and full domain compromise.

Suspicious Direct etcd Database Access via etcdctl With Server Certificates (via process_creation)

This rule detects execution of etcdctl using the etcd server certificates and the local etcd endpoint to read or write cluster state directly. Post-exploitation of a compromised etcd in Kubernetes clusters abuses this path to bypass the kube-apiserver and its admission controls. Direct database access lets an attacker read secrets or inject resources with full control over the cluster.

Malicious Inbox Rule Hiding Security Mail to RSS Feeds via M365 (via m365)

This rule detects creation of an Exchange Online inbox rule that moves messages into the RSS Feeds folder and marks them as read. This is a common business email compromise technique to hide security notifications and replies from the compromised user. Concealing warning mail lets the attacker operate the mailbox and pursue fraud undetected.

Suspicious Kubernetes SelfSubjectAccessReview Permission Enumeration

This rule detects creation of SelfSubjectAccessReview or SelfSubjectRulesReview objects which are used to enumerate the permissions granted to the current identity as described in NCC Group Kubernetes detection engineering research. Adversaries query their own effective RBAC access to plan privilege escalation and lateral movement so bursts of these reviews should be investigated.

Suspicious Privileged or Host Namespace Kubernetes Pod Creation

This rule detects creation of Kubernetes pods that request privileged containers or share the host PID IPC or network namespaces as described in NCC Group Kubernetes detection engineering research. Adversaries deploy such pods to break container isolation and gain access to the underlying node which is a common container escape and persistence technique.

Malicious Kubernetes Reconnaissance Tooling Activity

This rule detects Kubernetes reconnaissance and attack tooling either via the Rakkess access matrix user agent or the deployment of known offensive container images such as kubiscan kube-hunter and kubestriker as described in NCC Group Kubernetes detection engineering research. Adversaries run these tools to map RBAC permissions and hunt for cluster misconfigurations before privilege escalation.

Malicious DLL Sideloaded by Microsoft Office Application

This rule detects a Microsoft Office application loading one of the specific DLLs abused for the MS15-132 DLL hijack such as elsext dll oci dll and the winrt forwarder library as described in NCC Group Office DLL hijacking research. Adversaries deliver a document with an OLE object via the browser that drops a malicious DLL next to the document so Office resolves and executes attacker code for initial access.

Malicious Office Persistence via WLL Add-In Dropped to Word STARTUP Folder

This rule detects creation of a Word add-in library file in the Microsoft Word STARTUP folder which the Sisfader RAT uses for persistence after CVE-2017-8570 exploitation. Observed in NCC Group research on CVE-2017-8570 RTF documents delivering the Sisfader RAT via an SCT to WLL chain. WLL add-ins auto-load with Word which makes this a reliable persistence detection.

Suspicious JSP Webshell Compiled Class Creation in Web Application Work Directory

This rule detects creation of a compiled JSP class named welcome_jsp associated with the webshell dropped during F5 and Citrix exploitation observed by NCC Group. Web application servers compile deployed JSP files into class artifacts and an unexpected welcome webshell class indicates server side code execution persistence.

Suspicious File Written to Startup Folder by DllHost COM Surrogate

This rule detects dllhost.exe writing files into the user Startup folder, matching Blister loader behaviour that abuses the IFileOperation COM interface via the DllHost surrogate to copy its payload for persistence while evading direct file-write monitoring. The COM surrogate is rarely a legitimate producer of Startup persistence artifacts and indicates staging of an auto-run payload.

Suspicious Rundll32 Copied to Startup Folder via Blister Loader

This rule detects a copy of rundll32.exe being written into the user Startup folder, a persistence technique used by the Blister loader which drops rundll32.exe alongside its own payload DLL to auto-run at logon. Placing a legitimate system binary outside System32 in a Startup path is a strong sign of DLL proxy execution being staged for persistence.

Malicious Kernel Driver Load from User AppData Directory

This rule detects loading of known malicious kernel driver file names from a user AppData directory which is an abnormal location for signed drivers. NCC Group attributed netfilter and related drivers to a rootkit that manipulates network traffic and hides malicious activity. Loading a driver from a writable user path indicates rootkit installation and kernel level defense evasion.

Possible Team9 C2 via Emercoin bazar Domain Resolution

This rule detects DNS queries for domains under the Emercoin .bazar top-level domain used by the Team9 malware family for resilient command-and-control. Resolution of a .bazar name from an enterprise host is highly unusual and strongly suggests a blockchain-based C2 channel.

Malicious SharkBot Android Banking Trojan C2 via DGA Domain Suffix

This rule detects DNS resolution of domains containing the unique SharkBot domain generation algorithm suffix used to locate command and control infrastructure as documented by NCC Group. The trojan falls back to algorithmically generated domains sharing a hardcoded token making that constant a high confidence indicator of infection.

Suspicious Azure Contributor Role Assignment to Identity

This rule detects an Azure role assignment granting the built-in Contributor role, the privilege-escalation step used in the Azure Fabric backdoor where a service principal or managed identity was granted Contributor at resource-group scope from a Fabric notebook to drive the control plane. Contributor grants to non-human identities warrant review as a persistence and escalation vector.