Sigma detection rules, expert-reviewed

Malicious Service Creation to Execute tscon for RDP Session Hijacking

This rule detects registration of a Windows service whose image path invokes tscon.exe with a destination session, the mechanism adversaries use to run tscon under the SYSTEM service context and hijack an inactive Remote Desktop session. Standalone tscon execution is insufficient for this technique, so a service wrapping tscon is a strong signal of session hijacking. Legitimate services do not invoke tscon in this manner.

Malicious WordPress Webshell session-manager PHP in mu-plugins

This rule detects creation of a session-manager.php file inside the WordPress must use plugins directory. ErrTraffic deploys this file as a persistent server side backdoor on compromised WordPress installations. A PHP file named session-manager.php dropped into mu-plugins is characteristic of this web shell and rarely legitimate.

Malicious Clearing of Windows Event Logs (via process_creation)

This rule detects command-line clearing of Windows event logs through wevtutil or the PowerShell Clear-EventLog and Remove-EventLog cmdlets, an indicator-removal action used to destroy forensic evidence. Defense evasion via log tampering appears throughout the Red Canary Threat Detection Report, typically after an adversary has established access and wants to cover their tracks. Because legitimate bulk log-clearing on endpoints is rare, this is a high-fidelity signal of hands-on-keyboard activity.

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.

Malicious File Copy via Esentutl Volume Shadow Access (via process_creation)

This rule detects esentutl.exe invoked with the /vss switch to copy a locked file such as ntds.dit or a credential database from a volume shadow copy, a credential-access technique that sidesteps file locks. Esentutl shadow-copy abuse is tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces theft of protected credential material.

Suspicious MSC File with Double Extension (via file_event)

This rule detects creation of a Microsoft Management Console file that uses a document double extension to disguise itself as a PDF. The FLUX#CONSOLE campaign delivered an ARRVL themed pdf.msc file to exploit MMC for payload execution.

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

This rule detects execution of the processor.sh or migrate-repos.sh shell scripts from the tmp directory used by the Shai-Hulud npm supply-chain worm. These stagers harvest cloud and repository credentials then drive self-propagation by republishing infected packages. Running these named scripts out of tmp is a direct indicator of the worm on a developer or build host.

Suspicious RMM Daisy-Chain Action1 Spawning ScreenConnect via process_creation

This rule detects the Action1 RMM agent spawning a ScreenConnect client process. Threat actors daisy-chain remote management tools by using one deployed RMM to install and launch a second, giving them redundant remote access, so an Action1 process launching ScreenConnect indicates chained rogue RMM deployment rather than normal single-vendor management.

Suspicious IIS Logging Disabled via appcmd

This rule detects appcmd.exe being used to disable IIS request logging with the dontLog setting, matching defense-evasion activity in the Defence Impairment intrusion. Adversaries turn off IIS logging to hide webshell and web-based command execution from server logs. Disabling logging on a web server is a strong anti-forensic signal.

Suspicious Run Key Masquerading as GoogleUpdate From Wrong Path via Registry Set (via registry_set)

This rule detects a Run key autostart entry masquerading as GoogleUpdate but pointing to a payload outside the legitimate Google update directory, a persistence and masquerading technique used by malware from MSIX installers per Red Canary. A trusted-looking name paired with the wrong file path is a high-confidence indicator of a malicious autorun disguised as software updater.

Suspicious Interpreter Spawned by launchd from Application Bundle

This rule detects the macOS launchd process directly spawning a shell or script interpreter that executes a payload located inside an application bundle Contents/MacOS path. This behavior corresponds to the CVE-2021-30657 Gatekeeper bypass where an app lacking an Info.plist is launched without notarization checks. It lets attackers run arbitrary code while evading Gatekeeper.

Malicious IFEO Debugger Hijack of vds.exe by FishMonger

This rule detects registration of an Image File Execution Options Debugger value for vds.exe, a persistence and defense-evasion technique used by the FishMonger group deploying SprySOCKS. The activity abuses the IFEO mechanism so that a malicious binary is launched whenever the Virtual Disk Service is invoked. Detecting this key is important because it silently redirects execution of a legitimate system component to attacker-controlled code.

Malicious kagent RAT Delivery via HuggingFace Space Download (via process_creation)

This rule detects a shell downloading and executing an installer script hosted on a HuggingFace Space on Linux hosts. The marimo blockchain botnet campaign delivered the kagent NKN based remote access trojan through an install-linux.sh script pulled from a HuggingFace Space domain. Piping a remote Space installer into a shell indicates malware delivery.

Malicious TCP Session Hijacking via rshijack

This rule detects execution of the rshijack tool used to inject data into established TCP sessions. Wiz Research observed rshijack abused inside a shared Replicate environment to hijack traffic to a central Redis instance, so its use strongly indicates adversary in the middle or lateral movement activity.

Malicious Vulnerable Driver HwRwDrv Loaded for BYOVD

This rule detects loading of the HwRwDrv vulnerable driver, a bring-your-own-vulnerable-driver component observed in a Huntress-tracked Tiflux RMM malspam campaign to gain privileged kernel access. Attackers load this signed but vulnerable driver to tamper with protected processes and security tooling. Presence of this driver name is a strong indicator of BYOVD privilege escalation.