Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Persistence Masquerading as Update Tasks

This rule detects creation of scheduled tasks named UpdateSystem or UpdateUser via schtasks, a persistence and propagation mechanism used by The Gentlemen ransomware. Masquerading tasks as benign update jobs helps the encryptor survive reboots and relaunch across compromised hosts.

Suspicious Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of volume shadow copies using vssadmin or wmic, an inhibit recovery step performed by The Gentlemen ransomware before encryption. Removing shadow copies prevents victims from restoring files and is a strong pre-encryption indicator of a destructive attack.

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

This rule detects execution of The Gentlemen ransomware Go encryptor invoked with its signature command line flags controlling self propagation and fast encryption. The presence of these operator flags together indicates active deployment of a self-propagating encryptor and imminent data destruction across the environment.

Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)

This rule detects sqlite3 being used to read or write the macOS TCC.db privacy database, an injection technique Sapphire Sleet uses to grant itself access to protected resources without user consent. Adversaries tamper with TCC.db to bypass macOS privacy controls covering the camera, microphone, and full disk access, so direct sqlite3 access to this database is a strong indicator of privacy-control subversion.

Malicious Sapphire Sleet curl to osascript Chain With mac-cur User-Agent (via process_creation)

This rule detects a curl download piped into osascript while using the distinctive mac-cur user-agent, the staged execution chain Sapphire Sleet uses after a fake software update to fetch and run AppleScript payloads on macOS. Adversaries use this pattern to pull second-stage code and execute it in memory, so the mac-cur marker combined with curl and osascript exposes the intrusion at the download-and-execute stage.

Malicious React Server Component RCE via Node Web Process Spawning Shell (via process_creation)

This rule detects a Node.js or Next.js server process spawning a shell that runs reconnaissance or download commands such as whoami, curl, or wget, the exploitation pattern for the CVE-2025-55182 React2Shell flaw in React Server Components. Adversaries trigger this to gain remote code execution on internet-facing servers before dropping miners and RATs, making the web-process-to-shell chain an early signal of active exploitation.

Suspicious TruffleHog Credential Scanner Execution in Developer Context (via process_creation)

This rule surfaces execution of the TruffleHog secret-scanning tool, which the Shai-Hulud 2.0 worm runs on infected hosts to harvest cloud and repository credentials from local files before exfiltrating them. Because TruffleHog is also a legitimate security tool, this behavior warrants review when it appears on developer or build systems outside sanctioned scanning, where it can indicate active credential theft.

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

This rule detects registration or use of a self-hosted GitHub Actions runner named SHA1HULUD, a distinctive artifact of the Shai-Hulud 2.0 supply chain worm as it establishes persistence in victim GitHub organizations. Adversaries register attacker-controlled runners to execute workflows and exfiltrate secrets from CI pipelines, so the hardcoded runner name is a high-confidence indicator of an active compromise.

Suspicious Remote Monitoring Tool Executing from GoAnywhere Directory

This rule detects remote monitoring and management tools such as SimpleHelp or MeshAgent executing from within a GoAnywhere installation directory. Microsoft observed attackers deploying these RMM tools under GoAnywhere folders following CVE-2025-10035 exploitation to maintain access. RMM binaries running from a file-transfer application path are out of place and indicate attacker-installed remote access.

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

This rule detects the GoAnywhere Tomcat process spawning powershell or cmd running host discovery commands such as whoami and systeminfo. Microsoft observed this chain during active exploitation of CVE-2025-10035 in GoAnywhere Managed File Transfer. A file-transfer web application launching reconnaissance commands indicates post-exploitation hands-on activity.

Malicious XCSSET LaunchDaemon Persistence Executing Hidden root Script

This rule detects a LaunchDaemon or shell invocation that runs a hidden dot-root script from the user home directory via bash. Microsoft observed XCSSET dropping a fake System Settings.app and a LaunchDaemon that executes ~/.root for persistence. A hidden script launched at daemon scope is atypical for legitimate software, so this pattern indicates the persistence mechanism.

Suspicious Base64 Decoding Piped to Shell on macOS

This rule detects base64 decoded output piped directly into a shell interpreter. Microsoft observed XCSSET decoding base64 and OpenSSL-encrypted stages and executing them inline. Piping decoded content straight to sh or bash hides the payload from static inspection, making it a strong obfuscated execution indicator on macOS.

Suspicious Hex Decoding Piped to Shell via xxd on macOS

This rule detects a shell command that reverses a hex dump with xxd and pipes the output directly into a shell interpreter. Microsoft observed the updated XCSSET malware using echo piped through xxd -p -r into sh to decode and run its payload. Decoding hex inline to execution is an obfuscation and defense-evasion pattern rarely seen in benign scripts.

Suspicious Defender and Session Reconnaissance via sc query and quser

This rule detects reconnaissance querying the Microsoft Defender sense and windefend services with sc query. Microsoft observed Storm-0501 running these checks alongside quser and net commands before cloud-based ransomware deployment. Enumerating security service state is a precursor to evasion, so querying these specific services warrants scrutiny.

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

This rule detects certutil.exe adding a certificate to the root or CA store using the addstore and Enterprise options. Microsoft observed Secret Blizzard installing a rogue root certificate to enable adversary-in-the-middle interception of diplomat traffic. Trusting an attacker root certificate allows silent TLS decryption, so this command reveals the interception setup.