Sigma detection rules, expert-reviewed

CHCP CodePage Locale Lookup

Detects use of chcp to look up the system locale value as part of host discovery

Possible DLL Side-Loading via printui.exe Outside System32

This rule detects execution of printui.exe from a directory outside the legitimate System32 path which enables side-loading of a rogue printui.dll. The Tangerine Turkey campaign copies printui.exe next to a malicious printui.dll to load cryptomining code. Detecting execution from unexpected paths surfaces DLL search order hijacking used for evasion and code execution.

Suspicious Self-Deletion via Ping Loopback and Del (via process_creation)

This rule detects a cmd command that pings the loopback address as a delay before deleting a file which the HiddenGh0st malware uses to remove its dropper. This ping and delete pattern is a common self cleanup indicator following execution.

Malicious Backdoored liblzma XZ Utils Library File via file_event

This rule detects the creation of the backdoored liblzma shared object versions 5.6.0 and 5.6.1 associated with the XZ Utils supply chain compromise (CVE-2024-3094). The implanted library hooks the OpenSSH authentication routine to allow remote unauthenticated access. Presence of these specific library versions on a host indicates a compromised software supply chain requiring immediate remediation.

Suspicious Payload Execution From Private Temp Directory via Process Creation

This rule detects execution of a binary located under the macOS private temp directory, the staging path used in the HM Surf exploitation chain to run a downloaded second-stage payload. Adversaries drop tools into world-writable temp locations and execute them there to evade scrutiny before establishing persistence.

Suspicious PIKABOT Command and Control Connection on Non-Standard Ports via Network Connection

This rule detects outbound connections to the uncommon high ports 2967 2223 and 5938 that PIKABOT uses for its HTTPS command and control while spoofing an Outlook user agent. These ports are atypical for normal web traffic so outbound sessions to them warrant review though some remote access software may reuse similar ranges.

Malicious Service Creation to Execute tscon for RDP Session Hijacking

This rule detects registration of a Windows service whose image path invokes tscon.exe with a destination session, the mechanism adversaries use to run tscon under the SYSTEM service context and hijack an inactive Remote Desktop session. Standalone tscon execution is insufficient for this technique, so a service wrapping tscon is a strong signal of session hijacking. Legitimate services do not invoke tscon in this manner.

Malicious WordPress Webshell session-manager PHP in mu-plugins

This rule detects creation of a session-manager.php file inside the WordPress must use plugins directory. ErrTraffic deploys this file as a persistent server side backdoor on compromised WordPress installations. A PHP file named session-manager.php dropped into mu-plugins is characteristic of this web shell and rarely legitimate.

Renamed Autohotkey Binary

Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Suspicious Outbound Connection to InvisibleFerret C2 Ports 1224 and 1245

This rule detects outbound TCP connections to the uncommon ports 1224 and 1245 used by the InvisibleFerret and BeaverTail command and control servers in the North Korean job-hunter campaigns per Unit 42. These fixed high ports carry the actor heartbeat and tasking traffic which is rare for legitimate applications and flags an infected host.

Malicious Clearing of Windows Event Logs (via process_creation)

This rule detects command-line clearing of Windows event logs through wevtutil or the PowerShell Clear-EventLog and Remove-EventLog cmdlets, an indicator-removal action used to destroy forensic evidence. Defense evasion via log tampering appears throughout the Red Canary Threat Detection Report, typically after an adversary has established access and wants to cover their tracks. Because legitimate bulk log-clearing on endpoints is rare, this is a high-fidelity signal of hands-on-keyboard activity.

Suspicious Nimbus Manticore Agent Polling Endpoints over HTTP (via proxy)

This rule detects HTTP requests to the /agent/init, /agent/poll, and /agent/result endpoints used by the Nimbus Manticore native implant to register, poll for tasking, and return results from Azure-hosted command-and-control infrastructure. Adversaries leverage these structured routes to operate the beacon while blending into web traffic, making detection valuable for exposing active command-and-control.

Suspicious colorcpl.exe Spawned for Process Injection via Lua Loader (via process_creation)

This rule detects the TTF Trap loader creating colorcpl.exe in a suspended state as a host for shellcode injection. The Color Management applet colorcpl.exe is rarely launched programmatically and almost never by script interpreters or user path binaries. A colorcpl.exe child of such a parent indicates injection.

Suspicious AWS EC2 RunInstances of Large Compute-Optimized Instance for Cryptomining

This rule detects EC2 RunInstances launching oversized compute-optimized instance types such as c5a.24xlarge, matching the resource hijacking behavior of exposed IAM key operators tracked by Unit 42. Adversaries spin up high-core instances to maximize cryptomining throughput which drives sudden cloud spend and indicates account compromise.

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.