Sigma detection rules, expert-reviewed

Malicious Linux systemd Persistence nvmconf.service

This rule detects creation of a systemd unit named nvmconf.service, the Linux persistence installed by the Mastra npm supply chain compromise. The service masquerades as Node version manager configuration to relaunch the malicious payload across reboots.

Suspicious ASPX Web Shell Drop on IIS Server

This rule detects creation of web shell files named Errors.aspx, Signoff.aspx or ghost.inc that were planted on internet-facing servers during a stealthy third-party compromise. Web shells give the attacker persistent remote command execution over HTTP which is a common foothold for follow-on lateral movement.

Malicious Sapphire Sleet LaunchDaemon Masquerading as Google WebKit Service (via file_event)

This rule detects creation of a LaunchDaemon property list named com.google.webkit.service.plist, a persistence artifact Sapphire Sleet plants on macOS while masquerading as a legitimate Google WebKit service. Adversaries install this daemon to survive reboots and maintain access after the initial lure compromise, so the appearance of this spoofed daemon name is a high-confidence sign of the implant.

Malicious Marbled Dust OMServerService VBScript Dropped to Startup Folder

This rule detects the creation of OMServerService.vbs inside the Start Menu Startup folder. Microsoft observed the Marbled Dust actor abusing an Output Messenger zero-day to drop this file via path traversal for persistence. Placing a VBScript in the Startup folder guarantees execution at logon, so this file event strongly indicates the espionage intrusion.

Suspicious Web Shell ASPX File Created in Exchange OWA Auth or SharePoint LAYOUTS Path (via file_event)

This rule detects creation of web-shell ASPX files named getidtoken.aspx or signout.aspx within Exchange OWA authentication, aspnet_client, or SharePoint LAYOUTS directories, the persistence artifacts dropped in attacks against on-premises Exchange and SharePoint servers. Adversaries place shells with authentication-themed names in trusted server paths to blend in and retain access, so these files appearing in those locations indicate web-shell installation.

Suspicious CLFS Base Log File Created in SkyPDF ProgramData Path during Zero-Day Exploitation (via file_event)

This rule detects creation of the CLFS base log file PDUDrv.blf under a SkyPDF ProgramData directory, the on-disk artifact of the Common Log File System zero-day exploitation that precedes privilege escalation and ransomware deployment. Adversaries craft a malicious .blf to trigger the CLFS vulnerability, so this specific file path appearing on a host is a strong indicator of exploitation.

Suspicious Entra Sign-In With Axios Automation User-Agent via AiTM Token Replay (via azure)

This rule detects Microsoft Entra sign-ins presenting the axios/1.7.9 automation user-agent, a distinctive marker of Storm-2755 replaying stolen tokens through an adversary-in-the-middle framework in payroll pirate attacks against Canadian employees. Because interactive user sign-ins do not originate from the axios HTTP library, this user-agent on authentication traffic strongly indicates automated token replay rather than a legitimate user.

Suspicious Azure Tenant Root Elevation via elevateAccess

This rule detects the Microsoft.Authorization elevateAccess action that grants a Global Administrator root access over all Azure subscriptions. Microsoft observed Storm-0501 abusing this to seize control of the cloud estate before ransomware impact. Tenant-wide elevation is a rare, high-privilege operation, so this action should be verified against expected administrative change.

Suspicious Token Request Using Microsoft Authentication Broker Client to Obtain Primary Refresh Token (via azure)

This rule detects token requests made through the Microsoft Authentication Broker client toward the Device Registration Service, the sequence Storm-2372 uses after harvesting device-code tokens to register an actor-controlled device and obtain a Primary Refresh Token. Adversaries leverage the broker client and a rogue device registration to gain durable access to a victim tenant, making this pairing a high-value detection for post-phishing persistence.

Suspicious Oracle EBS Web Shell Access via X-ORACLE-DMS-ECID Header

This rule detects web requests carrying the X-ORACLE-DMS-ECID header used as an activation trigger by the SAGEWAVE servlet-filter web shell deployed against Oracle E-Business Suite. Requiring this uncommon header gates the malicious filter so only the operator can invoke it, indicating covert post-exploitation access.

Malicious Oracle EBS Exploitation via SyncServlet and TemplatePreviewPG

This rule detects web requests to the Oracle E-Business Suite /OA_HTML/SyncServlet and TemplatePreviewPG endpoints carrying the TMP or DEF template codes abused in CVE-2025-61882 exploitation. This request pattern drives injection of a malicious XSL template that leads to remote code execution in the widespread extortion campaign.

Suspicious vCenter VAMI SSH Enable via appliance access API

This rule detects an HTTP PUT to the vCenter VAMI endpoint /rest/appliance/access/ssh on management port 5480, matching BRICKSTORM activity that re-enables SSH on the appliance to gain shell access. Turning on this remote-access channel supports stealthy lateral movement and backdoor deployment across the virtualization estate.

Malicious WIREFIRE Webshell Access on Ivanti Connect Secure API Path (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/cav/client/visits endpoint that WIREFIRE trojanizes into a webshell. Suspected APT actors modified this component to accept encrypted commands and payloads through crafted requests to that URI. Traffic to this specific tampered API path signals interaction with the WIREFIRE backdoor.

Malicious Snowflake Bulk Data Exfiltration via External Stage COPY INTO (via cloud)

This rule detects Snowflake query activity that stages an entire table into a temporary stage and copies it out with GZIP compression, matching the UNC5537 exfiltration playbook that used CREATE TEMPORARY STAGE followed by COPY INTO and GET to pull data from compromised customer instances. Bulk staged exports are a hallmark of Snowflake data theft and extortion operations.

Malicious ESX Admins Group Added to Privileged Directory Group

This rule detects an Active Directory security event adding an ESX Admins group or member, matching the UNC3944 method of creating that specific group name to inherit administrative access to vSphere through its default AD integration. The distinctive group name indicates targeting of the virtualization estate rather than routine administration.