Sigma detection rules, expert-reviewed

Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog

This rule detects PowerShell launched directly by explorer.exe while fetching and executing remote content inline, matching the ClickFix fake-CAPTCHA lure that tricks users into pasting an attacker command into the Windows Run prompt to stage the LOSTKEYS downloader. This user-driven execution grants COLDRIVER an initial foothold without dropping a file to disk.

Suspicious System Reconnaissance via Windows Script Host

This rule detects a Windows Script Host process (wscript or cscript) spawning built-in reconnaissance utilities such as systeminfo, ipconfig, net view and tasklist, matching the LOSTKEYS VBS payload used by COLDRIVER to profile compromised hosts. This host-profiling burst precedes credential and document theft against Western government and NGO targets.

Suspicious Robocopy of Signal Directory to Public Staging Path by UNC1151 (via process_creation)

This rule detects robocopy copying a Signal application directory into a Users Public staging location, the collection and staging technique UNC1151 used to gather Signal data before exfiltration. Copying messaging data to a shared public path is a common pre-exfiltration staging behavior.

Suspicious sqlcipher Decryption of Signal Database by WAVESIGN (via process_creation)

This rule detects sqlcipher.exe being run against a Signal SQLite database, the decryption step in the WAVESIGN batch tooling used by Russia-aligned actors to read Signal message stores before rclone exfiltration. Command line decryption of a messaging database indicates targeted communications theft.

Malicious Sed Tampering of Ivanti Debug and Audit Logs (via process_creation)

This rule detects sed being used to edit the Ivanti Connect Secure debuglog and audit.log files in place, the selective log tampering technique used during zero-day exploitation to remove evidence of PHASEJAM web shell activity. In-place editing of appliance logs indicates indicator removal by an intruder.

Malicious CivilDefense Loader Spawning civildefensestarter Payload (via process_creation)

This rule detects the CivilDefense lure executable spawning civildefensestarter.exe, the Pronsis Loader chain used in a Russia-aligned campaign to stage PURESTEALER against Ukrainian military recruits. The parent-child masquerade using civil defense themed filenames indicates second-stage loader execution.

Suspicious Scheduled Task Named Sumatra Launcher by UNC2970 (via process_creation)

This rule detects creation of a scheduled task named Sumatra Launcher, the persistence mechanism UNC2970 registered to run the BURNBOOK loader daily at logon after delivering a trojanized SumatraPDF reader. A logon-triggered task masquerading as a PDF viewer helper indicates backdoor persistence.

Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)

This rule detects PowerShell launched with the hidden window, unrestricted execution policy and no-profile flag combination used by the PEAKLIGHT downloader to fetch and AES-decrypt a memory-resident payload. This flag stacking is characteristic of obfuscated fileless staging.

Malicious IIS Worker Process Spawning conn.exe Web Shell Child by APT41 (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning a masqueraded conn.exe child process, a pattern consistent with APT41 web shell command execution on compromised web servers. A web server process launching arbitrary tooling is a strong indicator of an installed web shell.

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

This rule detects execution of the sqluldr Oracle bulk unload utility, which APT41 used to export data from Oracle databases prior to exfiltration. This uncommon administrative tool is rarely seen in most environments and its presence often indicates staged database theft.

Malicious CrowdStrike Falcon RTR Abuse Downloading From fleetdeck.io by UNC3944 (via process_creation)

This rule detects curl commands reaching the remote management tooling endpoints fleetdeck.io or the external IP echo service icanhazip.com, which UNC3944 executed through abused CrowdStrike Falcon Real Time Response runscript access to stage remote access software. Attacker abuse of a trusted EDR RTR channel to deploy tooling is a strong indicator of hands-on-keyboard intrusion.

Suspicious APT42 Command Obfuscation via Environment Variable Substitution and Call (via process_creation)

This rule detects cmd.exe defining an environment variable and then re-invoking it through call with a character-removal substitution to reconstruct a hidden command such as curl. APT42 used this set and call pattern with variable substitution to obscure download commands from simple string inspection. Building commands from variable substitution at runtime is a deliberate obfuscation technique.

Malicious Rogue F5 BIG-IP Administrator Account Creation via tmsh (via process_creation)

This rule detects the F5 tmsh utility creating an authentication user with an administrator role. Initial access brokers exploiting F5 BIG-IP CVE-2023-46747 provisioned a rogue admin account to lock in privileged appliance control. Creation of a new admin-role user on a network appliance is a strong persistence and account-manipulation indicator.

Malicious Python Reverse Shell One-Liner Execution (via process_creation)

This rule detects Python invoked with an inline -c one-liner that opens a socket and duplicates its file descriptors onto a shell, the hallmark of a reverse shell. Actors targeting Ivanti Connect Secure used Python reverse shells for interactive access after exploitation. Inline socket-to-shell Python is a high-confidence remote-access indicator.

Malicious Ivanti Log Clearing via logClear Perl Script (via process_creation)

This rule detects execution of a logClear Perl utility used to selectively remove appliance log entries on compromised Ivanti Connect Secure devices. The actor ran this tooling to delete Integrity Checker and system events tied to their intrusion, frustrating forensic review. Purpose-built log-clearing tooling on an appliance is a clear indicator-removal action.