Sigma detection rules, expert-reviewed

Malicious Stealth Soldier C2 User-Agent (via proxy)

This rule detects outbound web requests carrying the hardcoded Stealth Soldier user-agent string used by the Stealth Soldier backdoor in espionage attacks across North Africa. This static, tool-specific user-agent is a distinctive command-and-control fingerprint that legitimate clients do not present.

Suspicious Rogue WordPress REST Route morning/v1 (via webserver)

This rule detects requests to a rogue REST route morning/v1 registered by the wp2shell web shell to execute commands via a base64 parameter passed to passthru. Access to this attacker-defined route indicates an active web shell on the WordPress host. The specific route name is characteristic of this implant.

Malicious User Browser Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.

Malicious AutoHotkey Script Execution From ProgramData (via process_creation)

This rule detects AutoHotkey.exe running an .ahk script from a subdirectory of C:\ProgramData which the DarkGate loader uses to execute its interpreted payload after a template injection chain. Abusing the legitimate AutoHotkey interpreter to run scripts from a staging directory evades script host controls and hides malicious logic.

Suspicious Executable Started from Windows Help Directory via Process Creation

This rule detects execution of a portable executable located in the Windows help directory which is abnormal for that folder and was used by the REF5961 intrusion set to run the RUDEBIRD loader from C\Windows\help. Attackers place binaries there to masquerade as benign system content and evade path-based scrutiny.

Suspicious Scheduled Task Executing JavaScript from Public Directory (via process_creation)

This rule detects creation of a scheduled task that executes a JavaScript file from the Users Public Downloads directory. The Caminho loader registered tasks named amandes or amandines to run a persistence script from this world-writable location every minute.

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

This rule detects a malicious cron entry that uses wget piped to bash observed during exploitation of the GlobalProtect CVE-2024-3400 vulnerability. Attackers established persistence and staged tooling through /etc/cron.d/update. Download-and-execute cron jobs provide resilient footholds on compromised appliances.

Suspicious Java Runtime Execution from LocalAppData Staging Folder

This rule detects javaw executing from a user LocalAppData staging directory used by the Xeno stealer. The malware bundles a private Java runtime under Java and Microsoft GameDVR paths to run its malicious JAR while blending in with normal directories.

Malicious Active Directory Database Dump via ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked to create a full Install-From-Media snapshot of the Active Directory database, the credential-dumping step observed on domain controllers prior to NTDS.dit exfiltration. Adversaries leverage ntdsutil to extract every domain hash in one operation, making detection of the IFM and full snapshot subcommands critical for catching domain-wide credential theft.

Malicious Reverse Shell via socat

This rule detects socat spawning a shell over a TCP connection, a reverse-shell pattern used by the Outlaw Linux malware for remote access. socat invoked with both an EXEC or SYSTEM shell handler and a TCP endpoint is characteristic of interactive command-and-control rather than benign relaying.

Suspicious Scheduled Task Creation Running DLL from ProgramData

This rule detects schtasks.exe creating a scheduled task whose action invokes rundll32 against a DLL located in ProgramData, matching the persistence mechanism of the WARMCOOKIE backdoor. Adversaries register such tasks so the loader runs automatically after reboot or logon.

Malicious PostgreSQL COPY FROM PROGRAM Command Execution via Managed Cloud Database (via process_creation)

This rule detects the PostgreSQL server process spawning a shell or command utility, the primitive Wiz Research abused through COPY FROM PROGRAM in GCP Cloud SQL and Azure Database for PostgreSQL to run operating-system commands and open reverse shells. Since the database engine should not launch interpreters, such child processes indicate exploitation of database privileges for code execution and container escape.

Malicious VenomRAT Offline Keylog File Creation via file_event

This rule detects creation of the DataLogs_keylog_offline keystroke capture file that VenomRAT writes under the user AppData MyData directory. This hardcoded artifact path marks active offline keylogging by the VenomRAT payload delivered through the fake CVE-2023-40477 proof-of-concept, indicating credential and data theft on the host.

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

This rule detects forfiles.exe enumerating win.ini and using its command flag to launch PowerShell and mshta, matching the PEAKLIGHT LNK-driven infection chain that abuses forfiles as a proxy execution binary. This technique launches a memory-only downloader while evading direct process lineage detection.

Malicious Remote Process Execution From an SMB Admin Share (via process_creation)

This rule detects a process whose image is executed directly from a remote SMB administrative share (a UNC path into ADMIN$ or C$), a lateral-movement pattern used to run tools copied to a remote host. Lateral movement over admin shares is featured in the Red Canary Threat Detection Report and underpins many hands-on-keyboard intrusions and ransomware deployments. Detecting execution from a UNC admin-share path surfaces the pivot as it happens.