Sigma detection rules, expert-reviewed

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

This rule detects a hex or base64 encoded blob being decoded with xxd or base64 and piped directly into a shell, the obfuscated execution technique used by the updated XCSSET macOS malware to run its payloads. Adversaries encode commands to hide intent from static inspection and decode-and-run them in memory, so a decode utility feeding sh in one pipeline is a reliable indicator of obfuscated script execution.

Suspicious NetSupport Manager Remote Client Execution (via process_creation)

This rule detects execution of the NetSupport Manager remote-control client32.exe, the remote access tool dropped as the final payload of the GitHub-hosted info stealer chain in this malvertising campaign. Adversaries repurpose the legitimate NetSupport client as a covert RAT for hands-on-keyboard control, so client32.exe running in an environment without a sanctioned NetSupport deployment indicates remote-access compromise.

Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)

This rule detects findstr filtering a running process list for security-vendor process names such as wrsa, opssvc, AvastUI, AVGUI, and bdservicehost, the environment-fingerprinting step used by the GitHub-hosted info stealers delivered through this malvertising campaign. Adversaries enumerate installed defenses to decide whether to proceed or evade before deploying NetSupport and stealer payloads, making this tasklist-and-findstr pattern an early execution indicator.

Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)

This rule detects a ScreenConnect remote-access client process spawning PowerShell or cmd, an abuse of legitimate remote-management software used by the Seashell Blizzard subgroup to run commands on compromised hosts during the BadPilot campaign. Because adversaries co-opt installed RMM tooling to blend into normal administration, scripting children of ScreenConnect warrant scrutiny in environments where such automation is not expected.

Malicious IIS Worker Process Spawning Command Shell after ASP.NET ViewState Injection (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command interpreters or reconnaissance utilities, the post-exploitation behavior seen when adversaries inject code through publicly disclosed ASP.NET machine keys to execute the Godzilla framework on an IIS server. Attackers use forged ViewState payloads validated by leaked machineKey values to run arbitrary commands in the web server context, making this parent-child pattern a strong indicator of server compromise before further lateral movement.

Suspicious Replaced Filesystem Helper Execution from Library Filesystems Bundle (via process_creation)

This rule detects execution of newfs or fsck filesystem helper binaries from a third-party /Library/Filesystems bundle when not launched by the expected disk-management daemons, matching the replaced-binary technique used in the CVE-2024-44243 System Integrity Protection bypass. Adversaries swap these SIP-heritable helpers to gain code execution with protected privileges, so surfacing anomalous invocation exposes tampering before a malicious kernel extension is loaded.

Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)

This rule detects the SIP-heritable daemon storagekitd spawning a third-party filesystem binary located under /Library/Filesystems, the core behavior of the macOS System Integrity Protection bypass tracked as CVE-2024-44243. Adversaries abuse storagekitd com.apple.rootless.install.heritable entitlement to run attacker-controlled newfs and fsck helpers with SIP-bypassing privileges, making early detection critical for stopping kernel extension loading and rootkit installation.

Suspicious Windows Defender Support Directory Enumeration via Process Creation

This rule detects a directory listing command targeting the Windows Defender Support folder under ProgramData, a reconnaissance action embedded in the RC4 batch script used by Secret Blizzard during its Amadey and Tavdig deployment chain. Enumerating this Defender path helps the actor assess the environment before staging further payloads.

Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation

This rule detects the Remote Desktop client opening an .rdp configuration file launched from a downloads, temp or Outlook attachment directory, the delivery vector in the Midnight Blizzard spear-phishing campaign. The malicious signed RDP files enable bidirectional resource mapping of drives, clipboard and printers to attacker servers, exposing local data on connection.

Suspicious Scheduled Task Creation Named SysUpdate via Process Creation

This rule detects creation of a scheduled task named SysUpdate via schtasks, the mechanism Storm-0501 used to deploy Embargo ransomware across hosts through Group Policy. A masquerading update-themed task name pushed to many endpoints can indicate staged ransomware execution.

Suspicious Rclone Exfiltration via Masqueraded svchost Process Creation

This rule detects a process masquerading as svchost through typosquatted names running Rclone-style transfer arguments, a data exfiltration technique used by Storm-0501 to move stolen files to attacker cloud storage. Renaming Rclone to svhost.exe or scvhost.exe is an attempt to hide exfiltration behind a trusted-looking Windows binary name.

Suspicious npm Package Spawning cURL Download via Process Creation

This rule detects an npm or node process spawning curl to fetch a remote payload, a supply chain execution technique in which Moonstone Sleet distributed malicious npm packages that pulled the SplitLoader malware during install. A package manager launching a download utility is unusual and can indicate a trojanized dependency.

Suspicious LSASS Memory Dump via Procdump Process Creation

This rule detects Procdump being run against the LSASS process to capture a memory dump for offline credential extraction, a technique used by the North Korean actor Moonstone Sleet during intrusions. Dumping LSASS yields plaintext and hashed credentials that enable lateral movement and privilege escalation.

Suspicious OpenSSH Reverse Tunnel Creation via Process Creation

This rule detects the Windows OpenSSH client creating a reverse port-forwarding tunnel, a technique used after Quick Assist abuse to establish covert remote access into compromised environments. Operators tunnel traffic to maintain access and move laterally, so an interactive ssh reverse tunnel from an endpoint is worth reviewing.

Malicious Forest Blizzard GooseEgg Persistence via WinSrv Scheduled Task as SYSTEM (via process_creation)

This rule detects creation of a scheduled task under the Microsoft Windows WinSrv path running as SYSTEM. Forest Blizzard registered this task with schtasks to persist and run its GooseEgg exploitation tool with elevated privileges.