Sigma detection rules, expert-reviewed

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

This rule detects wevtutil clearing Windows event logs which ransomware operators perform to destroy evidence of intrusion and lateral movement. Clearing logs immediately before or after encryption impairs incident response and timeline reconstruction.

Malicious Scheduled Task Masquerading as Auto Update via schtasks (via process_creation)

This rule detects creation of a scheduled task named Auto apdate that launches Trays.exe at logon with highest privileges, the persistence mechanism used in the AnyDesk phishing campaign targeting Russian aerospace firms. The misspelled update-themed task name masquerades as a benign auto-updater to hide malicious auto-start, so catching the task registration exposes the persistence before the tool executes.

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

This rule detects sSH brutforce a Windows OpenSSH server with a valid user.

Malicious Koske DNS Configuration Locking via chattr (via process_creation)

This rule detects the Koske malware hardening its hijacked DNS configuration by overwriting /etc/resolv.conf with attacker chosen resolvers and then setting the immutable attribute with chattr. Locking resolv.conf prevents defenders and legitimate services from restoring name resolution. This behavior is rare on production Linux hosts.

Malicious Word Spawning Rundll32 Loading DLL from Roaming Word Folder

This rule detects winword.exe launching rundll32.exe to load a DLL staged under the AppData Roaming Microsoft Word directory which is the Hancitor maldoc execution chain preceding Cuba ransomware. The malicious macro drops and side loads the loader from a user writable path. It is important because this parent child pattern reliably marks initial Hancitor infection.

Malicious wp2shell Batch Endpoint Exploitation (via webserver)

This rule detects POST requests to the WordPress batch REST endpoint that return HTTP 207 multi-status, matching in-the-wild exploitation of wp2shell for CVE-2026-63030 and CVE-2026-60137. Attackers chain requests through the batch route to reach vulnerable handlers and drop a web shell. The 207 response to the batch route is characteristic of this exploitation.

Suspicious Service DLL Persistence Under Masquerading Service Names

This rule detects a ServiceDll value being set under the COMSysConfig or StorSyncSvc service keys which the ColunmTK APT41 cluster registers to load a malicious DLL through a svchost hosted service. The names impersonate legitimate Windows components to blend in. It is important because ServiceDll hijacking grants stealthy SYSTEM level persistence.

Suspicious PowerShell Invoke-WebRequest Download of Executable Payload

This rule detects PowerShell using Invoke-WebRequest to download an executable payload to disk. UAT-6382 used this technique after web-shell access to pull additional tooling from staging infrastructure over a non-standard port, a common ingress-tool-transfer step preceding beacon deployment.

Suspicious Kernel Service Creation for BYOVD Driver Loading (Qilin)

This rule detects creation of a kernel-type Windows service via sc create with a kernel service type, used by the Qilin group to load a vulnerable driver for bring-your-own-vulnerable-driver attacks. Loading a kernel driver through a newly created service enables disabling security products from kernel space. Unexpected kernel service creation is a strong defense-evasion signal.

Malicious PlugX Run Key Persistence via AvastSvcpCP Path

This rule detects a Run key value pointing at the AvastSvcpCP directory under the user profile used by the PlugX USB worm for persistence. PlugX copies its sideloading set into this folder and registers it for autostart, masquerading as Avast to survive reboots.

Malicious Cactus Ransomware Ransom Note Creation (via file_event)

This rule detects creation of Cactus ransomware ransom notes, which embed the fixed C.A.c_T.U-S-R.e-a_D.m-e marker between randomized prefixes and postfixes in the note filename. Adversaries leverage mass note deployment during the encryption stage, making detection of this distinctive embedded string a reliable late-stage indicator of a Cactus impact event.

Malicious Disabling of Huntress Updater via systemctl Stop

This rule detects systemctl being used to stop the huntress-updater service, an anti-forensic and defense-evasion action observed in a Huntress Linux intrusion where the actor disabled the security agent before continuing cryptomining. Stopping the endpoint agent blinds detection and prevents updates. Targeted termination of a named security service by an attacker is high-confidence malicious activity.

Suspicious Scheduled Task Masquerading as MicrosoftEdgeUpdate with Minute Interval (via process_creation)

This rule detects creation of a scheduled task that impersonates the Microsoft Edge updater while triggering on a very short minute-based interval. The AsyncRAT phishing campaign registers a task named MicrosoftEdgeUpdate500 that runs every two minutes for persistence. Legitimate updaters do not run on such aggressive schedules, so this pairing of a trusted name with an abnormal trigger reveals the persistence mechanism.

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

This rule detects AWS STS GetCallerIdentity calls which the Hugging Face breach actor issued to validate stolen cloud credentials after harvesting secrets from a compromised AI agent environment. Identity self-checks are a common first move once keys are obtained. Because legitimate automation also calls this API, baseline expected principals and alert on unfamiliar or first-seen callers.

Suspicious Scheduled Task Launching svczHost Masquerading Binary via schtasks

This rule detects schtasks creating a task that runs svczHost.exe, a masquerading binary imitating the legitimate svchost service name used for persistence in the Ducktail campaign. Attackers pick a lookalike host name so the scheduled task and running process blend into normal system activity.