Sigma detection rules, expert-reviewed

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

This rule detects OAuth application permission grants for high privilege mailbox scopes such as full_access_as_app EWS.AccessAsUser.All and ApplicationImpersonation. Midnight Blizzard granted these permissions to attacker-controlled applications to access mailboxes across the tenant.

Suspicious Creation of PowerShell Profile Script for Persistence

This rule detects creation or modification of a PowerShell profile script. Backdoors abuse the automatic execution of the profile file on every PowerShell launch to gain stealthy persistence, running an obfuscated loader each time a session starts.

Possible React Server Components Exploitation via Next-Action Header

This rule detects inbound web requests carrying a Next-Action server action header together with crafted action parameter markers, the request shape used to trigger CVE-2025-55182 in React Server Components. Exploitation abuses the server action deserialization path to reach arbitrary command execution. Requests bearing this header alongside the action index syntax against a Next.js application warrant investigation for RCE attempts.

Malicious PPL Abuse via ClipUp Protected Process Launch

This rule detects the ClipUp.exe utility launched with a protected process light argument, the technique RONINGLOADER uses to spawn a signed binary as a PPL and disable Microsoft Defender. Abusing ClipUp to obtain a protected process lets the loader tamper with security services that normally block it.

Suspicious Host.exe In Windows Directory Running As Service

This rule detects execution of host.exe from the Windows directory with a service-style command line switch. BlackByte ransomware operators deployed C:\Windows\host.exe run with an -s flag and an eight-digit token to register itself as a service. A generically named binary placed in the Windows root and launched as a service is a masquerading and persistence pattern used to blend malicious execution into the OS.

Malicious Command Execution Spawned by Apache Tomcat

This rule detects the Tomcat service process spawning command interpreters or administrative utilities, indicating web application remote code execution such as the Samsung MagicINFO exploitation observed by eSentire. A Java web server launching cmd, PowerShell, or account management binaries is a strong sign of server-side exploitation leading to cryptomining deployment.

Possible Super SSRF via Jira Server nativemobile batch CVE-2022-26135

This rule detects POST requests to the Jira Server /rest/nativemobile/1.0/batch endpoint used to perform blind server-side request forgery. CVE-2022-26135 abuses this batch API with an attacker-controlled location value as shown by Assetnote, allowing requests to arbitrary internal hosts and cloud metadata.

Malicious In-Memory Payload Execution via PowerShell DownloadString (via process_creation)

This rule detects PowerShell downloading a script from a remote host and immediately executing it in memory using DownloadString together with Invoke-Expression, a fileless technique used by a ransomware actor after ColdFusion exploitation to run Cobalt Strike beacons and reverse shells. Combining a web download with immediate expression evaluation is a common malicious loader pattern.

Suspicious PHP Stream Wrapper in Query-String CLI Argument

This rule detects HTTP requests combining injected CLI option syntax in the query string with remote PHP stream wrappers such as ftp, phar, or php filter, matching the Craft CMS argv injection to remote code execution chain documented by Assetnote. Attackers use these wrappers to load remote templates or configuration and pivot to code execution. The pairing of a leading double-dash option with a wrapper scheme strongly indicates exploitation rather than benign parameters.

Suspicious DNS Zone Export via dnscmd for Reconnaissance

This rule detects use of dnscmd with the zone export option to dump an Active Directory DNS zone to a file, a reconnaissance technique used by the Karakurt extortion actor to enumerate internal hosts and services. A full zone export gives an attacker a map of the environment to plan lateral movement and target high-value systems.

Suspicious DLL Sideloading via Renamed fixmapi Swom.exe Loading Mapistub.dll via Confucius (via image_load)

This rule detects Confucius persistence in which the legitimate fixmapi.exe is copied to Swom.exe in AppData and side loads a malicious Mapistub.dll from LocalAppData. The genuine Mapistub.dll is a system component so loading it beside a renamed fixmapi binary indicates the loader. This chain establishes the backdoor.

Suspicious Network Scanning Tool Execution

This rule detects execution of network and port scanning utilities such as SoftPerfect Netscan and Advanced Port or IP Scanner that were used for internal reconnaissance as described in NCC Group Fivehands ransomware research. Adversaries run these scanners after initial access to map reachable hosts and services before lateral movement so their presence on servers or non administrator hosts is suspicious.

Untrusted Disabling of macOS System Integrity Protection (via process_creation)

This rule detects csrutil disable, which turns off System Integrity Protection so an attacker can modify protected system locations and load unsigned kernel code on macOS. Disabling SIP is a defense-evasion technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces removal of a core macOS protection.

Malicious User Account Control Bypass via Auto-Elevating Binary Hijack (via process_creation)

This rule detects a known auto-elevating Windows binary such as fodhelper, computerdefaults, eventvwr or sdclt spawning a command shell or script interpreter, the tell-tale child-process pattern of a User Account Control bypass. UAC bypasses are a recurring privilege-escalation and defense-evasion technique in the Red Canary Threat Detection Report, letting adversaries obtain a high-integrity process without a prompt. Detecting these parent-child pairs surfaces the elevation attempt.

Suspicious Kubernetes Service Account Token Generation via kubectl

This rule detects the use of kubectl create token to mint a service account token which attackers abuse after compromising an Amazon EKS node to impersonate service accounts and pivot from the Kubernetes cluster into the connected cloud account.