Sigma detection rules, expert-reviewed

Suspicious OpenSSH Reverse Tunnel Creation via Process Creation

This rule detects the Windows OpenSSH client creating a reverse port-forwarding tunnel, a technique used after Quick Assist abuse to establish covert remote access into compromised environments. Operators tunnel traffic to maintain access and move laterally, so an interactive ssh reverse tunnel from an endpoint is worth reviewing.

Malicious Forest Blizzard GooseEgg Persistence via WinSrv Scheduled Task as SYSTEM (via process_creation)

This rule detects creation of a scheduled task under the Microsoft Windows WinSrv path running as SYSTEM. Forest Blizzard registered this task with schtasks to persist and run its GooseEgg exploitation tool with elevated privileges.

Suspicious Remote Payload Download Piped to Shell on Linux (via process_creation)

This rule detects curl or wget downloads piped directly into a shell interpreter. Attackers exploiting OpenMetadata used this pattern to retrieve and execute a cryptominer without writing an intermediate file.

Malicious Reverse Shell via Netcat or Shell Redirection on Linux (via process_creation)

This rule detects Netcat invoked with a command execution flag or a bash dev tcp redirection used to establish an interactive reverse shell. Attackers exploiting OpenMetadata used these techniques for hands-on access to compromised Kubernetes workloads.

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

This rule detects processes invoking Interactsh out-of-band domains such as oast.me and oast.pro. Attackers exploiting critical OpenMetadata vulnerabilities on Kubernetes used these callbacks to confirm remote code execution before deploying a cryptominer.

Suspicious curl Download Launched from PDF Shortcut Lure (via process_creation)

This rule detects curl.exe fetching remote content when spawned from a shortcut with a double pdf.lnk extension. Mint Sandstorm delivered fake PDF shortcuts that invoked curl to download follow-on payloads.

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

This rule detects the Windows App Installer binary launching a remote MSIX package through the ms-appinstaller protocol handler and ServerName argument. Financially motivated actors abused this vector to deliver BATLOADER and Cobalt Strike while bypassing SmartScreen.

Malicious TeamCity Persistence via Scheduled Task Masquerading as Settings UI (via process_creation)

This rule detects creation of a scheduled task named Windows TeamCity Settings User Interface. North Korean actors registered this deceptively named task after exploiting TeamCity CVE-2023-42793 to persist their implant on the server.

Malicious Local Administrator Account Added via net localgroup (via process_creation)

This rule detects use of net.exe to add an account to the local administrators group. North Korean actors exploiting TeamCity CVE-2023-42793 created and elevated a rogue account named krtbgt to establish privileged persistence.

Suspicious xp_cmdshell Enabled via sp_configure Reconfigure (via process_creation)

This rule detects command lines that enable the xp_cmdshell extended stored procedure through sp_configure and RECONFIGURE. Threat actors turned on xp_cmdshell to gain operating system command execution from a compromised SQL Server instance.

Malicious Cloud Instance Metadata Token Theft via IMDS Identity Endpoint (via process_creation)

This rule detects command lines requesting an OAuth token from the Azure instance metadata service identity endpoint at 169.254.169.254. Threat actors queried IMDS from a compromised SQL Server host to steal the managed identity token and move laterally into the cloud.

Malicious SQL Server Command Shell Spawn via sqlservr Child Process (via process_creation)

This rule detects the SQL Server engine process sqlservr.exe spawning a command shell or scripting interpreter. Threat actors enabled xp_cmdshell on a compromised SQL Server to run OS commands as a foothold before pivoting to the cloud environment.

Suspicious Peach Sandstorm Remote Access via AnyDesk Tooling (via process_creation)

This rule detects execution of the AnyDesk remote access utility. Peach Sandstorm deployed AnyDesk alongside custom tunneling to maintain hands-on-keyboard access to compromised high-value targets.

Suspicious Peach Sandstorm Entra ID and ARM Enumeration via AzureHound or Roadtools (via process_creation)

This rule detects execution of cloud directory enumeration tooling such as AzureHound and Roadtools roadrecon. Peach Sandstorm ran these tools to enumerate Entra ID and Azure Resource Manager objects during discovery for follow-on intelligence collection.

Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to a file. Flax Typhoon dumped these hives to extract local account password hashes for offline cracking and credential access.