Sigma detection rules, expert-reviewed

Possible Malicious MCP Server Credential Exfiltration via DevTools-Assistant Agent (via proxy)

This rule detects outbound HTTP requests carrying the DevTools-Assistant user agent or destined for the api.github-analytics.com host used by the trojanized MCP server to exfiltrate stolen developer credentials. The custom user agent string and attacker controlled domain are distinctive network markers of this supply-chain compromise. Such traffic represents active data theft from a developer workstation.

Suspicious SparkKitty Photo Exfiltration API Pattern

This rule detects network requests to the SparkKitty spyware image-collection API paths such as getImageStatus putImages and putDataInfo used to upload stolen photos from infected mobile devices. This Trojan spy embedded in App Store and Google Play apps harvests gallery images that may contain wallet seed phrases. The structured API endpoint set is a distinctive server-side indicator.

Suspicious StupidSandwichAgent User-Agent in C2 Traffic by StaryDobry

This rule detects outbound HTTP requests carrying the hardcoded StupidSandwichAgent User-Agent string used by the StaryDobry campaign loader. This unusual and unique agent value identifies command-and-control and payload retrieval traffic from the miner dropper. Presence of this User-Agent indicates StaryDobry C2 communication.

Suspicious CanesSpy WhatsApp Mod C2 Beacon to AllRequest Endpoint (via proxy)

This rule detects HTTP POST requests to the /api/v1/AllRequest endpoint used by the CanesSpy trojanized WhatsApp modification for command-and-control. The spyware polls this path roughly every 60 seconds to receive orders and exfiltrate device identifiers, so traffic to this structured URI indicates an infected client beaconing to its C2.

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

This rule detects forced BitLocker volume encryption via manage-bde or the Enable-BitLocker cmdlet, the impact stage of the printer-and-BitLocker extortion scheme that encrypts victim disks for ransom. Attackers weaponize the built-in BitLocker feature to lock out victims without deploying custom ransomware, so unexpected encryption activity warrants investigation.

Suspicious MSSQL xp_cmdshell Enablement via sp_configure (via process_creation)

This rule detects command lines that enable the MSSQL xp_cmdshell feature through sp_configure, a preparatory step used in the printer-and-BitLocker extortion scheme to unlock operating system command execution from the database. Enabling xp_cmdshell is a strong indicator of an attacker preparing to run OS commands via a compromised SQL server.

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

This rule detects 7-Zip creating a password protected archive using the hardcoded password embedded in the GoSerpent backdoor tooling. The specific static password uniquely identifies the actor collection and exfiltration staging. Password protected archiving with this constant is a high-confidence collection indicator.

Suspicious Scheduled Task Masquerading as Apple Sync via schtasks

This rule detects creation of an hourly scheduled task named Apple Sync, used by OkoBot to persist a reverse SSH connection. Apple synchronization software does not register tasks through ad-hoc schtasks commands under this name. A benign sounding task establishing recurring execution indicates attacker persistence.

Suspicious Network Packet Capture via netsh trace

This rule detects netsh starting a trace capture session, used by The Gentlemen operators to sniff network traffic during the intrusion. Ad-hoc packet capture on servers is uncommon outside of active troubleshooting. This can reveal credential or reconnaissance activity and warrants review.

Suspicious Defender Protection Disabled via Set-MpPreference

This rule detects Set-MpPreference being used to disable Microsoft Defender protections, a tamper step used by The Gentlemen ransomware operators before deploying payloads. Disabling real-time or behavior monitoring removes the primary endpoint control. This is a high-value defense-evasion signal.

Suspicious Command Shell Spawned by lmadmin License Manager via process_creation

This rule detects the lmadmin.exe license manager spawning a command shell or PowerShell, indicating post-exploitation of the Schneider Electric vulnerability including SeImpersonate Potato style privilege escalation. The license service has no legitimate need to launch interactive shells. A shell child under lmadmin points to exploitation and follow-on execution.

Malicious LSASS Memory Dump via procdump

This rule detects procdump creating a full memory dump of the lsass.exe process to harvest credentials, as performed in the StrikeShark campaign. Dumping LSASS memory yields plaintext and hashed credentials for lateral movement. This is a strong credential-access indicator even though procdump is a legitimate Sysinternals tool.

Malicious NTDS Extraction via ntdsutil IFM

This rule detects ntdsutil creating an Install From Media snapshot to extract the Active Directory database. The StrikeShark Cobalt Strike campaign uses this to steal domain credentials from a domain controller. NTDS extraction through ntdsutil is a high-confidence credential-access indicator.

Suspicious Silent Installation of ManageEngine Endpoint Central RMM via msiexec

This rule detects msiexec silently installing ManageEngine Endpoint Central agent software, the remote management tool abused by the WhatsApp VBScript campaign for persistent remote access. Unattended RMM deployment on endpoints that do not normally run it indicates attacker-controlled tooling. Legitimate deployments should be allowlisted.

Suspicious wermgr Execution Outside System Directories via process_creation

This rule detects the Windows Error Reporting Manager wermgr.exe running from a path outside System32 and SysWOW64. The MiniPlasma exploitation chain launches a masqueraded wermgr.exe from an unexpected location. A trusted system binary name executing from the wrong directory indicates masquerading and likely process injection.