Sigma detection rules, expert-reviewed

Malicious LSASS Credential Dump via rundll32 and comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export to dump the memory of LSASS, a credential theft technique observed in the 2025 NTLM abuse campaigns. Attackers call comsvcs.dll MiniDump against the LSASS process id to write its memory to disk and later extract secrets. This is a well-established living-off-the-land method for harvesting cached credentials and NTLM hashes.

Suspicious PowerShell Execution Bypass Running Script From ProgramData

This rule detects PowerShell launched with an execution policy bypass to run a script stored in C\ProgramData, matching the ToddyCat loader that executed c\programdata\ip445.ps1. Staging scripts in the world-accessible ProgramData directory and bypassing execution policy is a common tradecraft for running attacker tooling with minimal friction. The combination is unusual for legitimate administrative scripts.

Suspicious node.exe Execution From LocalAppData Directory

This rule detects the Node.js runtime node.exe running from a user LocalAppData nodejs directory, the location abused by the Tsundere botnet. The malware ships its own Node.js runtime under %LOCALAPPDATA%\nodejs and executes malicious JavaScript through it. Legitimate Node installations typically live under Program Files, so a node.exe launched from LocalAppData indicates a bundled malicious runtime executing attacker script.

Suspicious Chrome Browser Process Spawned by Outlook Indicating Sandbox Escape

This rule detects the Outlook process spawning a Chrome browser process, an anomaly tied to the ForumTroll exploitation of CVE-2025-2783. The attackers abused an Outlook link to launch Chrome and escape its sandbox, loading a malicious DLL for follow-on execution. Outlook does not normally parent a Chrome process directly, so this parent-child relationship strongly suggests exploitation of the browser via email delivery.

Suspicious osascript Spawning Shell Interpreter on macOS

This rule detects osascript spawning a shell such as zsh or bash with an inline command, a chain used by the BlueNoroff GhostCall and GhostHire campaigns to bridge AppleScript into shell execution. Attackers use osascript to run AppleScript that then invokes /bin/zsh -c to execute follow-on commands and download stages. This AppleScript-to-shell handoff is a common macOS execution technique for staging payloads.

Suspicious Safari-Masquerading LaunchAgent Loaded via launchctl on macOS

This rule detects launchctl loading or unloading a LaunchAgent that masquerades as a Safari component such as com.applet.safari. The BlueNoroff GhostCall campaign installed persistence through fake Safari LaunchAgent plists and toggled them with launchctl. A LaunchAgent using an Apple-like label but not shipped by Apple indicates masqueraded persistence on macOS.

Suspicious TCC Privacy Database Reset via tccutil on macOS

This rule detects execution of tccutil reset which clears the macOS Transparency Consent and Control privacy permissions. The BlueNoroff GhostCall campaign manipulated the TCC database and reset permissions so its tooling could silently regain access to protected resources like the camera and screen recording. Resetting TCC is rarely done by normal users and is a strong signal of an attacker preparing to re-prompt or bypass privacy protections.

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell or scripting interpreter, a pattern seen when the PassiveNeuron actors deployed an ASPX webshell and executed commands through MSSQL. A database engine spawning cmd or PowerShell is highly abnormal and typically means the server has been compromised for remote command execution and initial foothold.

Suspicious Execution From Hidden fonts-unix Directory in tmp on Linux

This rule detects process execution from the hidden /tmp/.fonts-unix directory on Linux. The AdaptixC2 agent delivered through a malicious npm supply-chain package staged its Linux payload in this location to blend in with legitimate font-socket directories. Executing a binary from a world-writable hidden temp path is a strong indicator of malware staging and persistence on Unix hosts.

Suspicious Process Execution From Windows Tasks Directory

This rule detects process execution from the C\Windows\Tasks directory, an atypical location for legitimate executables. A malicious npm package delivering the AdaptixC2 agent staged its Windows payload in C\Windows\Tasks alongside a sideloaded msdtc.exe DLL. Because the Tasks folder is normally used only for legacy scheduled task metadata, running a binary from there strongly suggests payload staging and defense evasion.

Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File

This rule detects cmd.exe spawning PowerShell with an encoded command, a chain used by the Maverick banking Trojan distributed through WhatsApp. The malicious LNK launches cmd.exe which decodes and passes an obfuscated command to PowerShell. This layered command interpreter abuse is a common initial-access execution pattern designed to hide the real payload from casual inspection.

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

This rule detects installation or execution of the devtools-assistant package a trojanized MCP server used in a supply-chain attack against AI development tooling. Once run it enumerates and exfiltrates developer credentials from files such as .env .aws and .ssh. Catching the pip install or python module invocation flags the compromise at the point of execution.

Suspicious macOS Gatekeeper Disable via spctl (via process_creation)

This rule detects use of spctl to disable Gatekeeper through the master-disable or global-disable options. Disabling Gatekeeper lets unsigned and unnotarized applications run without user prompts which attackers exploit to execute downloaded payloads. This system-wide policy change is rarely performed on managed endpoints.

Suspicious macOS SIP Disable via csrutil (via process_creation)

This rule detects execution of csrutil disable which turns off macOS System Integrity Protection. Attackers disable SIP to load unsigned kernel extensions and tamper with protected system locations. Because this normally requires recovery mode its appearance in live telemetry points to deliberate weakening of platform defenses.

Malicious LSASS Memory Dump via dllhost ProcDump Masquerade (via process_creation)

This rule detects a process named dllhost.exe running with ProcDump style arguments to create a full memory dump of lsass.exe as observed with the PipeMagic backdoor. The genuine dllhost COM surrogate never accepts these switches so this is a renamed ProcDump used to steal credentials from LSASS. Capturing LSASS memory yields hashes and tickets for further compromise.