Sigma detection rules, expert-reviewed

Possible Team9 C2 via Emercoin bazar Domain Resolution

This rule detects DNS queries for domains under the Emercoin .bazar top-level domain used by the Team9 malware family for resilient command-and-control. Resolution of a .bazar name from an enterprise host is highly unusual and strongly suggests a blockchain-based C2 channel.

Malicious SharkBot Android Banking Trojan C2 via DGA Domain Suffix

This rule detects DNS resolution of domains containing the unique SharkBot domain generation algorithm suffix used to locate command and control infrastructure as documented by NCC Group. The trojan falls back to algorithmically generated domains sharing a hardcoded token making that constant a high confidence indicator of infection.

Suspicious Azure Contributor Role Assignment to Identity

This rule detects an Azure role assignment granting the built-in Contributor role, the privilege-escalation step used in the Azure Fabric backdoor where a service principal or managed identity was granted Contributor at resource-group scope from a Fabric notebook to drive the control plane. Contributor grants to non-human identities warrant review as a persistence and escalation vector.

Suspicious M365 Sign-In With axios Automation User-Agent (via azure)

This rule detects Azure AD sign-in activity presenting an axios HTTP client user-agent, observed during adversary-in-the-middle session token phishing against M365. Legitimate interactive users do not sign in with the axios library user-agent. Automated access with stolen session tokens indicates account takeover and mailbox abuse.

Possible SharePoint ToolShell Exploitation via ToolPane POST with SignOut Referer

This rule detects HTTP POST requests to the SharePoint ToolPane.aspx endpoint carrying a Referer header pointing to the SignOut page. Microsoft identified this request signature as the ToolShell exploit chain against on-premises SharePoint. The crafted Referer bypasses authentication to reach the vulnerable endpoint, so this combination indicates active exploitation.

Suspicious Access to IIS machine.config outside the Worker Process Context (via security)

This rule detects object-access auditing events for web.config or machine.config performed by a process other than the IIS worker or expected build tooling, a hunting signal for adversaries harvesting the validationKey and decryptionKey values that enable ViewState code-injection attacks. Stolen or leaked machine keys let attackers forge authenticated ViewState payloads, so unexpected reads of these files can reveal key theft before exploitation.

Malicious Run Key Persistence miasma-monitor from AsyncAPI npm Compromise

This rule detects an autorun Run key value named miasma-monitor, the Windows persistence installed by the AsyncAPI npm supply chain compromise import-time loader. The distinctive miasma named autostart relaunches the malicious payload at logon after a poisoned package is imported.

Malicious Run Key Persistence NvmProtocal Launching NodePackages Payload

This rule detects an autorun Run key named NvmProtocal or one referencing the NodePackages protocal.cjs payload, the Windows persistence dropped by the Mastra npm supply chain compromise. The misspelled Node branding launches PowerShell or Node from ProgramData at logon to maintain access after the malicious package installs.

Suspicious Run Key Persistence Masquerading as Google Update

This rule detects creation of autorun Run key values named GupdateS or GupdateU, persistence entries dropped by The Gentlemen ransomware that impersonate the Google Update service. The false Google branding hides the malicious autostart from casual inspection while ensuring the encryptor relaunches at logon.

Malicious Password Filter Registration via LSA Notification Packages

This rule detects registration of a rogue password filter DLL named passms in the LSA Notification Packages registry value, seen in a stealthy third-party supply chain intrusion. A malicious password filter receives every password change in cleartext, giving the attacker durable credential access across the domain.

Malicious Network Provider Registration via ProviderOrder Registry Key

This rule detects registration of a rogue network provider named mslogon in the NetworkProvider ProviderOrder registry key, observed during a stealthy intrusion staged through a third-party compromise. A malicious network provider intercepts credentials at logon time so the attacker can harvest plaintext passwords and sustain long-term covert access.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

This rule detects the WDigest UseLogonCredential value being set to 1, which forces Windows to cache cleartext credentials in memory. Storm-1175 enables this before dumping credentials during high-tempo Medusa ransomware operations. Adversaries use the change to recover plaintext passwords with tools like Mimikatz, so this registry modification is a strong precursor to credential theft and lateral movement.

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

This rule detects RunMRU registry values that capture LOLBIN commands such as powershell, mshta, rundll32, or msbuild pasted into the Windows Run dialog. Microsoft describes this as the core artifact of the ClickFix social engineering technique that tricks users into executing attacker commands. A scripting or proxy binary launched from the Run dialog is rare for legitimate users, so these entries flag the user-driven execution step.

Suspicious Firefox Enterprise Root Certificate Trust Enabled

This rule detects the Firefox preference security.enterprise_roots.enabled being set to true, forcing Firefox to trust certificates from the Windows root store. Microsoft observed Secret Blizzard enabling this so their rogue root certificate would be trusted by Firefox for AiTM interception. Because Firefox normally maintains its own trust store, this change extends the attacker root into the browser and enables traffic decryption.

Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog

This rule detects RunMRU registry values that record LOLBIN commands such as powershell or mshta typed into the Windows Run dialog. Microsoft observed Lumma Stealer ClickFix campaigns instructing victims to paste these commands, leaving artifacts in the RunMRU key. A scripting LOLBIN executed from the Run dialog is unusual for normal users and reveals the social engineering execution step.