Sigma detection rules, expert-reviewed

Malicious Snowflake Bulk Data Exfiltration via External Stage COPY INTO (via cloud)

This rule detects Snowflake query activity that stages an entire table into a temporary stage and copies it out with GZIP compression, matching the UNC5537 exfiltration playbook that used CREATE TEMPORARY STAGE followed by COPY INTO and GET to pull data from compromised customer instances. Bulk staged exports are a hallmark of Snowflake data theft and extortion operations.

Malicious ESX Admins Group Added to Privileged Directory Group

This rule detects an Active Directory security event adding an ESX Admins group or member, matching the UNC3944 method of creating that specific group name to inherit administrative access to vSphere through its default AD integration. The distinctive group name indicates targeting of the virtualization estate rather than routine administration.

Malicious STOCKSTAY Registry Run Key Persistence via MARKETMAKER Binaries (via registry_set)

This rule detects Registry Run key persistence whose value points to the StockMarketView, SMNet, or SMEditor executables used by Turla's MARKETMAKER loader in the STOCKSTAY intelligence gathering activity. Adversaries register these binaries under benign-looking run values to relaunch their toolset at logon, so this persistence entry is a reliable indicator of the campaign.

Suspicious Registry Run Key Persistence Masquerading as CanonPrinter

This rule detects creation of a Run key value named CanonPrinter, matching SOGU.SEC persistence that hides behind a Canon printer software name to relaunch the backdoor at logon. This trusted-name autorun entry maintains PRC-Nexus access to targeted diplomatic hosts across reboots.

Suspicious Registry Run Key Persistence Masquerading as Dropbox

This rule detects creation of an HKCU Run key value named Dropbox that points to an executable outside the legitimate Dropbox installation directory, matching STARKVEIL and FROSTRIFT persistence that hides behind a trusted application name. This false-context autorun entry survives reboot and relaunches the backdoor at logon.

Suspicious Windows Service Masquerading as Windows Defend by APT41 (via registry_set)

This rule detects creation of a Windows service registry key named Windows Defend, a deliberate misspelling of Windows Defender used by APT41 to blend malicious persistence with legitimate security tooling. Services impersonating security products are a defense evasion technique that grants persistent SYSTEM execution.

Malicious UNC1549 OneDrive-Masquerading Run Key Persistence (via registry_set)

This rule detects Run key values named to impersonate OneDrive components such as OneDriveFileCoAuth or OneDriveCoUpdate. UNC1549 planted these autorun entries to relaunch MINIBIKE side-loading at logon while blending with genuine OneDrive tasks. A Run value borrowing the OneDrive brand for a non-standard executable path is a persistence and masquerading indicator.

Suspicious Rundll32 Persistence via Registry Run Key (via registry_set)

This rule detects a Run key value being set to launch rundll32 at logon. The malvertising backdoor established persistence by writing a Run key that invokes rundll32 against a dropped DLL. Autorun entries that proxy execution through rundll32 are a well-known persistence and defense-evasion combination.

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

This rule detects a PowerShell New-NetFirewallRule command that opens the host for sshd inbound access as observed when ransomware operators enable SSH for lateral movement and persistence. Attackers create this rule to establish a resilient remote access path across the environment.

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

This rule detects PowerShell using Compress-Archive to package Signal configuration and database files, the collection step Turla performed to stage Signal data for exfiltration. Archiving a specific messaging application data directory indicates targeted collection of private communications.

Suspicious APT42 Remote Payload Download via PowerShell Web Client (via ps_script)

This rule detects PowerShell using wget, curl, or Invoke-WebRequest aliases to retrieve a remote configuration or payload file such as nconf.txt. APT42 pulled staged text-based payloads over PowerShell during post-compromise tooling deployment. Scripted retrieval of remote text payloads is a common ingress-tool-transfer behavior worth correlating with follow-on execution.

Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)

This rule detects execution of the Invoke-HuntSMBShares PowerShell cmdlet used to enumerate accessible network shares and their permissions. APT42 ran this PowerHuntShares tooling to map file shares for data collection during their operations. Broad SMB share hunting from PowerShell is a strong network discovery indicator in interactive intrusions.

Possible C2 via Google Sheets API Using Formula Render Option by GRIDTIDE

This rule detects requests to the Google Sheets API using the valueRenderOption set to FORMULA which the GRIDTIDE backdoor abuses to read tasking hidden inside spreadsheet formulas. Attackers use this legitimate cloud service as a covert command and control and exfiltration channel.

Possible Proxyware SDK Beacon With Telemetry Parameters

This rule detects HTTP requests carrying the proxyware SDK telemetry parameter string with n set to tlaunch alongside tag and key parameters used by PacketSDK and related residential proxy clients. This pattern indicates a device is reporting in as a monetized proxy node.

Suspicious Salesforce Data Access via Spoofed Automation User-Agents

This rule detects Salesforce API traffic carrying the distinctive spoofed user-agent strings Salesforce-Multi-Org-Fetcher/1.0 or python-requests used by UNC6395 after stealing Drift OAuth tokens. These clients drove SOQL enumeration and bulk extraction of User and Case records, indicating automated mass data theft rather than normal integration traffic.