Sigma detection rules, expert-reviewed

Malicious MuddyRot Payload Drop in ProgramData SoftwareMemory Directory

This rule detects creation of documentsmanagerreporter.exe inside a softwarememory folder under ProgramData, the staging path used by the MuddyWater MuddyRot implant during installation. Writing this specific file marks the initial deployment of the backdoor before persistence and C2 are established. Early detection at the drop stage allows containment before execution.

Suspicious Microsoft Entra Device Code Authentication Flow

This rule detects sign-ins that complete through the OAuth device code authentication protocol in Microsoft Entra. The EvilTokens phishing-as-a-service kit abuses the device code flow to trick victims into authorising attacker controlled devices and harvest refresh tokens. Because device code is uncommon for ordinary interactive users its appearance should be reviewed against expected device enrollment activity.

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

This rule detects Microsoft 365 sign-in attempts using the Azure PowerShell application id 1950a258-227b-4e31-a9cf-717495945fc2 against the Microsoft Graph resource identity, the combination the Quad7 botnet relies on for distributed password spraying. The operators relay authentication through compromised SOHO routers to validate stolen credentials at scale. Clustering on this AppId and resource surfaces the brute force activity for review.

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

This rule detects the AWS S3 API call PutBucketReplication which configures automatic replication of bucket objects to another bucket. Scattered Spider style actors abuse replication to silently copy sensitive data to an attacker controlled destination for exfiltration. Unexpected replication configuration on data buckets warrants immediate review.

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

This rule detects the AWS Route53 Domains API call DisableDomainTransferLock which removes the safeguard preventing a registered domain from being transferred away. Scattered Spider style actors disable this lock to hijack domains for phishing or to disrupt the victim. This administrative action is uncommon and should be verified against change management.

Suspicious AWS EC2 Serial Console Access Enabled via Scattered Spider Technique

This rule detects the AWS API call EnableSerialConsoleAccess which turns on account wide EC2 serial console access. Scattered Spider style intruders enable this to obtain out of band shell access to instances and bypass network and SSH controls. Because enabling serial console access is rare in normal operations it is a strong signal of hands on keyboard abuse.

Suspicious AWS Instance Access or Export via SSH Key or Export Task

This rule detects SendSSHPublicKey and CreateInstanceExportTask operations used to gain interactive access to or exfiltrate EC2 instances. Pushing a temporary SSH key via EC2 Instance Connect or exporting an instance image lets an attacker reach or copy workloads outside normal channels.

Suspicious AWS GuardDuty Detector Tampering

This rule detects tampering with AWS GuardDuty through DeleteDetector, UpdateDetector or CreateIPSet operations. Attackers disable the detector or add trusted IP allowlists so their activity is no longer flagged, undermining threat detection in the account.

Suspicious Rootkit Configuration Registry Keys (via registry_set)

This rule detects registry values written under SOFTWARE keys prefixed with the distinctive nya marker. The OBSCURE#BAT campaign stored rootkit DLLs, driver paths, and AES keys under these keys to configure its stealthy user-mode rootkit.

Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)

This rule detects a registry Run key value that points to a file located in the Public Libraries directory. The MULTI#STORM campaign created OneDrive Update Run keys referencing url files staged there for persistence.

Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)

This rule detects wscript or cscript spawning PowerShell that runs an Invoke-RestMethod download cradle. The Veil#Drop campaign used a JavaScript launcher under the script host to invoke a remote PowerShell loader.

Suspicious PowerShell Download Cradle to Blogspot (via process_creation)

This rule detects a PowerShell command using Invoke-RestMethod to fetch content from a Blogspot URL. The Veil#Drop campaign abused Blogspot as trusted infrastructure to stage and deliver a PowerShell loader for the PureLog stealer.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but which runs under a different image name. The Dead#Vax campaign executed a renamed PowerShell binary named mbs.exe to evade image based detections.

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

This rule detects PowerShell disabling Windows Defender behavior monitoring through Set-MpPreference. The DEEP#DOOR campaign disabled behavior and realtime monitoring to protect its Python backdoor from detection.

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

This rule detects PowerShell using Invoke-Expression to run code stored in an environment variable. The OBSCURE#BAT campaign staged its malicious PowerShell in a user environment variable and executed it fileless via this pattern.