Sigma detection rules, expert-reviewed

Malicious Ivanti Log Clearing via logClear Perl Script (via process_creation)

This rule detects execution of a logClear Perl utility used to selectively remove appliance log entries on compromised Ivanti Connect Secure devices. The actor ran this tooling to delete Integrity Checker and system events tied to their intrusion, frustrating forensic review. Purpose-built log-clearing tooling on an appliance is a clear indicator-removal action.

Suspicious Fake GIF Magic Header Written to Disguise Payload File (via process_creation)

This rule detects printf being used to write a GIF magic-byte header into a .gif file as a masquerading step. During Ivanti post-exploitation the actor prepended fake GIF headers so malicious content would pass as harmless image files. Manufacturing image magic bytes over shell is a deliberate file-type masquerading and obfuscation behavior.

Suspicious Base64 Decode Piped to Python Interpreter for In-Memory Execution (via process_creation)

This rule detects a shell command that decodes Base64 content and pipes it directly into a Python interpreter, often alongside an LD_LIBRARY_PATH override. During Ivanti Connect Secure exploitation the actor executed obfuscated Python payloads this way to run tooling without touching disk. Chaining base64 decoding into python is a common obfuscated in-memory execution pattern on Linux appliances.

Suspicious Silent MSI Installation of Non-Standard BIN Payload via Msiexec (via process_creation)

This rule detects msiexec silently installing a package that carries a non-standard .bin extension. A malvertising campaign distributing backdoors abused msiexec with a renamed .bin installer and the /qn quiet switch to deploy payloads without user interaction. Silent installation of an unusually named installer via a trusted system binary is a proxy-execution evasion technique.

Suspicious Domain Admins Group Enumeration via Net Command (via process_creation)

This rule detects the net command enumerating the Domain Admins group across the domain. After hijacking Citrix sessions via CVE-2023-4966, the actor performed privileged-group reconnaissance to identify high-value accounts for lateral movement. Querying Domain Admins membership is a classic early post-compromise discovery action.

Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)

This rule detects the mknod utility being used to create files within the /boot/os_tools/ directory on Linux-based appliances. UNC4841 staged dropper components in this boot-partition path to survive appliance updates and reboots on compromised Barracuda ESG devices. Writing executable content into the boot partition is highly abnormal and indicates deliberate low-level persistence.

Suspicious Okta Application Self-Assignment to All Applications by UNC3944 (via cloud)

This rule detects Okta application membership assignment events used by UNC3944 to grant a controlled identity access to all applications after compromising a SaaS tenant. Broad self-service application assignment expands attacker reach across integrated SaaS platforms and precedes data access and exfiltration.

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Suspicious Exchange Deletion of MFA Notification Emails

This rule detects Exchange SoftDelete and HardDelete operations that ShinyHunters actors use to remove multi factor authentication change notifications from a victim mailbox. Attackers purge these alerts to hide account takeover and MFA tampering from the legitimate user.

Suspicious SharePoint Search Queries for Sensitive Documents

This rule detects SharePoint search queries for sensitive terms such as confidential vpn poc and password as observed in ShinyHunters SaaS data theft reconnaissance. Attackers search compromised tenants to locate high value documents before exfiltration.

Suspicious SharePoint File Download Using PowerShell User Agent

This rule detects SharePoint or OneDrive file download events whose user agent contains PowerShell as observed in ShinyHunters branded SaaS data theft. Attackers script bulk downloads of documents after harvesting SSO credentials through vishing.

Suspicious Help Desk Impersonation via External Microsoft Teams Chat

This rule detects creation of a Microsoft Teams chat that includes users from a foreign tenant where the external participant display name contains help, a social-engineering pattern used by UNC3944 to impersonate IT help desk staff and coerce victims into resetting credentials or MFA. Attackers abuse this trusted-communication channel to gain initial access before escalating to enterprise systems.

Suspicious CANONSTAGER DLL Side-Loading via cnmpaui Executable

This rule detects the legitimate Canon utility cnmpaui.exe loading a DLL from a user-writable directory outside its normal Program Files location, matching the PRC-Nexus CANONSTAGER side-loading that launches the SOGU.SEC backdoor. Abusing a signed printer binary lets the actor execute malicious code under a trusted process during espionage against diplomats.

Malicious APT29 WINELOADER DLL Side-Load of vcruntime140.dll via SqlDumper (via image_load)

This rule detects the Microsoft SqlDumper.exe binary loading a vcruntime140.dll from a non-standard directory, the side-load chain APT29 used to run the WINELOADER backdoor. The actor paired a legitimate signed executable with a malicious runtime DLL to gain trusted execution. SqlDumper loading vcruntime140.dll outside canonical install paths is a high-fidelity side-loading indicator.

Malicious FortiManager Unregistered Device Add Indicating CVE-2024-47575 Exploitation (via application)

This rule detects the FortiManager event log message indicating an unregistered device from localhost was successfully added, the core exploitation artifact of the FGFM protocol zero-day CVE-2024-47575. Successful registration of an attacker-controlled device grants remote access to managed configuration data.