Sigma detection rules, expert-reviewed

Suspicious SQL Server - Connection Attempt Using a Disabled Account (via application)

This rule detects attempts authenticate to the database using a disabled user accont.

Suspicious MeshCentral Remote Command Execution via meshctrl (via process_creation)

This rule detects the MeshCentral meshctrl controller invoking RunCommand, the mechanism ShinyHunters used to push a fanout shell script to compromised PeopleSoft hosts in the education sector campaign. Adversaries abuse remote management platforms like MeshCentral to execute commands at scale across an estate, so controller-driven command execution should be validated against authorized administration.

Malicious WSUS Service Spawning Command Shell via Remote Code Execution

This rule detects the WSUS service or its IIS worker process spawning cmd or PowerShell, matching in-the-wild exploitation of the Windows Server Update Services remote code execution vulnerability. Successful exploitation grants command execution as the WSUS service account for reconnaissance and exfiltration. WSUS components have no legitimate reason to launch interactive interpreters.

Suspicious msimg32 DLL Hijack in AppData Templates

This rule detects msimg32.dll being loaded from the AppData Roaming Templates directory. AdaptixC2 plants a malicious msimg32.dll in this user path to hijack the DLL search order and gain execution. A system DLL name resolving from a user profile Templates folder is a clear DLL hijack indicator.

Malicious C2 Download Embedding Host Reconnaissance in URL

This rule detects wget or curl fetching a URL that embeds command substitution such as the current username, a beaconing pattern where the backdoor reports host context to its C2 while retrieving the next stage. Encoding whoami output into the request lets the operator track and profile infected hosts.

Suspicious PowerShell AES Decryption and Reflective Method Invocation in SolarMarker

This rule detects PowerShell that combines AES decryption primitives with reflective type loading and method invocation, the in memory staging used by SolarMarker to decrypt and run its second stage. Chaining cryptographic decryption with reflection lets the loader keep the real payload encrypted on disk and only expose it at runtime.

Suspicious Chafer Backdoor Registry Configuration under Microsoft DRM Key

This rule detects creation or modification of a Log value under the Microsoft DRM registry key which the Chafer backdoor uses as an execution gate and configuration store. Observed in NCC Group research analyzing the Chafer backdoor. Abuse of the DRM key as a covert configuration location is an uncommon behavior worth surfacing.

Malicious ZharkBot Execution via Explert Masquerade in Temp via process_creation

This rule detects the ZharkBot payload running as explert.exe from a Temp directory, a name chosen to mimic the legitimate Windows explorer process. Execution of an explorer look alike out of a user Temp folder is highly abnormal and reflects the loader staging its main module. The combined misspelled name and untrusted path make this a strong indicator of ZharkBot activity.

Malicious Inhibit System Recovery via Shadow Copy Deletion and Boot Configuration

This rule detects deletion of volume shadow copies and disabling of Windows recovery via bcdedit which active ransomware families execute before encryption. Observed in NCC Group research into active ransomware families including a BlackCat incident response engagement. Removing recovery options maximizes ransomware impact which makes this a high-confidence pre-encryption indicator.

Suspicious Directory Junction Creation via mklink for Masquerading

This rule detects cmd.exe creating a directory junction with mklink /D, the filesystem redirection RONINGLOADER uses to stage a fake roming directory during its PPL abuse chain. Directory junctions created by a command shell can trick trusted binaries into loading attacker-controlled content.

Suspicious Remote Scheduled Task Creation Running As SYSTEM

This rule detects schtasks.exe creating a task on a remote host that runs as SYSTEM at startup. In the WithSecure Catching Lazarus Part Two research the actor uses schtasks Create with a remote server, ONSTART schedule and the SYSTEM account for lateral movement and persistence. Attackers use remote task creation to execute code with high privilege on other machines.

Suspicious NPM Install Hook Executing Setup Script via Node

This rule detects an npm lifecycle process spawning node to run a setup.mjs script, the install-hook pattern used by malicious npm packages to execute code the moment a dependency is installed. This vector drives the npm supply chain attacks tracked by Unit 42. Detecting the hook-driven script run exposes attacker code executing during package installation before any application runs.

Suspicious AWS SSO Account Role Enumeration via ListAccountRoles (via cloudtrail)

This rule detects the AWS SSO ListAccountRoles call, the reconnaissance step Red Canary noted adversaries performing after obtaining a cached SSO access token to enumerate assignable roles. A burst of ListAccountRoles from an unfamiliar source can indicate an actor mapping available roles before assuming credentials.

Malicious Scheduled Task Masquerading as Windows Update by Screening Serpens (via process_creation)

This rule detects creation of scheduled tasks named WindowsSecurityUpdate or Synchronize OS via schtasks, a persistence technique used by the Iranian APT Screening Serpens. The tasks masquerade as legitimate system maintenance to relaunch the group's implants on a daily schedule.

Suspicious User Shell Folders Startup Path Modification (via registry_set)

This rule detects modification of the Startup entry under the Explorer User Shell Folders registry key. Adversaries redirect the Startup path to an attacker-controlled directory so that arbitrary programs launch at logon without touching the visible Startup folder. Changing this shell folder mapping is rare in normal operation and is a stealthy persistence technique.