Sigma detection rules, expert-reviewed

Suspicious Winlogon AutoAdminLogon Credential Registration

This rule detects enabling of Winlogon automatic logon by writing AutoAdminLogon, DefaultUserName or DefaultPassword under the Winlogon key. The ToyMaker access broker set these values so a reboot into their controlled session authenticates automatically, cementing persistence and easing the handoff of the compromised host to extortion affiliates.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.

Suspicious Active Directory Enumeration via AD Explorer Snapshot Process Creation

This rule detects the Sysinternals AD Explorer tool being run with the snapshot argument to capture an offline copy of Active Directory, a discovery technique used by Peach Sandstorm to enumerate accounts and objects. An AD snapshot pulls the full directory for later analysis and is rarely part of routine endpoint activity.

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

This rule detects execute Secretdump in order to remotely dump credentials over SMB.

Masquerading Systemd Service Masquerade via Systemctl Reenable of rsyslogd (via process_creation)

This rule detects systemctl reenabling a service named rsyslogd, the persistence behavior of the Kimsuky Gomir variant that installs a malicious rsyslogd service to impersonate the legitimate rsyslog logging daemon. Adversaries leverage the trailing d suffix to blend with real system services while ensuring the implant restarts, making early detection critical for surfacing masqueraded persistence before further intrusion activity.

Suspicious Base64 Decoding via Certutil

This rule detects certutil used with its decode flag to deobfuscate Base64-encoded content on disk. The KimJongRAT variant chains certutil and findstr to decode staged payloads before execution. Certutil-based decoding is a living-off-the-land deobfuscation technique that bypasses many controls.

WezRat Command and Control HTTP URI Pattern

This rule detects HTTP requests matching the WezRat command and control URI scheme including the distinctive wez Agent InsMch endpoint. The backdoor tasks and reads data through these fixed URI paths while spoofing a firefox user agent. Detecting the URI pattern reveals active command and control traffic.

Malicious LSASS Process Dump by a Non System Account (via security)

This rule detects will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Malicious LSB Steganography Image Decoding via PowerShell (via ps_script)

This rule detects PowerShell loading an image as a bitmap and iterating pixel values to extract an embedded payload. The Caminho loader used a GetPixel loop over a downloaded image to decode a hidden .NET assembly for fileless execution.

Suspicious AWS Inline Policy Granting Full S3 Access

This rule detects a PutUserPolicy call that attaches an inline IAM policy granting s3 wildcard permissions to a user. It maps to privilege escalation observed in S3 attack chains where an operator self-grants full bucket access before collection. Detecting it exposes IAM policy tampering aimed at cloud data theft.

Malicious Arkanix Stealer C2 Communication via Custom User-Agent

This rule detects outbound HTTP traffic carrying the hardcoded User-Agent string used by the Arkanix C++ and Python infostealer. Kaspersky observed Arkanix identifying itself to its panel with the ArkanixStealer client string while requesting stealer and hidden VNC modules. This distinctive agent is a reliable indicator of an infected host communicating with the stealer backend to receive payloads and exfiltrate credentials.

Suspicious Remote Script Execution via curl Piped to bash with nohup on macOS (via process_creation)

This rule detects a shell command that pipes curl output into bash and detaches it with nohup, the initial execution used by a macOS ClickFix campaign to run an AppleScript stealer in the background after terminal closure. Fetching and executing a remote script in one detached command with no visible output is a strong indicator of ClickFix-style delivery on macOS.

Malicious Payload Assembly via MZ Header Prepend and copy Concatenation (via process_creation)

This rule detects the technique of writing an MZ header and concatenating it with a downloaded blob using copy to reconstruct an executable, used by Bitter APT against PTCL to rebuild the WmRAT payload. The disguised binary is downloaded as a PNG then reassembled on disk. This MZ-prepend and copy pattern is a distinctive evasion behavior.

Malicious Mini Shai-Hulud TanStack C2 git-tanstack and getsession (via dns_query)

This rule detects DNS lookups for the git-tanstack.com payload host and getsession.org session channels used by the Mini Shai-Hulud TanStack npm compromise to fetch its Bun payload and exfiltrate stolen tokens. A resolution indicates the preinstall dropper has executed on a developer or CI host.

Suspicious VBScript Execution From ProgramData Microsoft Subfolder

This rule detects wscript or cscript executing a .vbs file from a subfolder under C:\ProgramData\Microsoft, a persistence and staging path used by Banana RAT. Legitimate scripts rarely run from these attacker-created directories.