Sigma detection rules, expert-reviewed

Suspicious Account Set with Password Not Required - Weakness Introduction (via security)

This rule detects set an account with password not required to perform privilege escalation attack.

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

This rule detects a base64 decoded payload being piped directly into a shell, the execution pattern of the injected reviewdog/action-setup install.sh that dumped CI runner memory. It matters because decode into shell in a build step is a common way supply chain payloads execute credential theft code without touching disk.

Suspicious Unattended AnyDesk Silent Install with Auto-Start

This rule detects a silent unattended AnyDesk installation configured to start with Windows, a remote-access-tool deployment pattern abused by threat actors to establish persistent covert remote control of a compromised host. The combination of silent install and auto-start flags indicates non-interactive attacker-driven deployment rather than a normal user setup.

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

This rule detects a Java process spawning a shell that runs host and domain reconnaissance commands. The Cleopatra Java backdoor, delivered by exploiting Cleo managed file transfer software, executed discovery utilities such as nltest, net view and systeminfo through child shells.

Malicious Tpwinprn DLL Loaded via Renamed rundll32 by Diplomatic Specter

This rule detects execution referencing the Tpwinprn.dll payload run through a renamed copy of rundll32 from SysWOW64, a loader behavior tied to the Operation Diplomatic Specter Chinese cyberespionage campaign. Renaming a signed system binary to proxy DLL execution helps the actor evade image-name detections. Detecting this reveals masqueraded loader activity delivering the espionage toolkit.

Suspicious Script Host Spawning PowerShell Or Cmd via Gootloader

This rule detects wscript.exe or cscript.exe launching PowerShell or cmd, matching the Gootloader chain where a malicious .JS extracted from a ZIP hands off to a shell. Gootloader delivers this JavaScript through SEO-poisoned search results posing as document templates. A Windows script host spawning a command interpreter is rarely benign on endpoints.

Suspicious Access to MOVEit Transfer Internal machine2 Endpoint

This rule detects HTTP access to the MOVEit Transfer machine2.aspx endpoint, which Assetnote identified during patch diffing as an internal-only interface reachable through SSRF in CVE-2023-34362. External or unexpected requests to this endpoint indicate an attacker has pivoted past the intended trust boundary. Because legitimate clients should not reach machine2 directly, such access is a strong exploitation signal.

Suspicious Run Key Persistence Masquerading as MicrosoftUpdate via Axios npm Compromise (via registry_set)

This rule detects creation of an HKCU Run value named MicrosoftUpdate, the persistence entry installed by the postinstall payload from the compromised Axios npm package to relaunch a dropped VBScript and PowerShell loader. Adversaries choose the MicrosoftUpdate name to blend with legitimate Windows tasks, so a Run value using this masquerading name warrants review for supply chain compromise.

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

This rule detects modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.

Suspicious Sednit Guardrailed Loader DLL Loaded Outside System32

This rule detects the Sednit SlimAgent and BeardShell loaders masquerading as eapphost.dll or tcpiphlpsvc.dll being loaded into their guardrail host processes explorer.exe, taskhost.exe or taskhostw.exe from a location outside the System32 directory. The genuine libraries live in System32, so a same-named module loaded from elsewhere into these processes indicates the impersonating implant.

Malicious SQL Server Spawning Command Interpreter via Mallox Ransomware

This rule detects the MS SQL Server process sqlservr.exe spawning a command interpreter such as cmd, PowerShell, or sqlps, the initial code-execution step in Mallox ransomware intrusions following database compromise. A database engine launching shells almost always reflects abuse of SQL for command execution and should be treated as an active intrusion.

Malicious Windows Defender Exclusion Path Addition via process_creation

This rule detects PowerShell using Add-MpPreference with the ExclusionPath parameter to exclude a directory from Windows Defender scanning. The Arcane stealer added Defender exclusions so its staged payloads under attacker controlled folders would not be inspected. Creating antivirus exclusions is a deliberate defense evasion step that usually precedes payload deployment.

Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)

This rule detects object access audit events for the DPAPI MachineKeys and the System (S-1-5-18) Protect directories by processes other than core system services, matching the file access seen while recovering active ADFS signing keys via machine DPAPI. Adversaries read these locations to obtain machine masterkeys and protected private keys, so unexpected access here indicates credential theft from key stores.

Suspicious PowerShell Console Window Hiding via ShowWindow

This rule detects PowerShell resolving GetConsoleWindow and calling ShowWindow to hide its own console, a stealth technique in the fake AI-tool installer chain that also re-executes itself for UAC. Hiding the window keeps the malicious script invisible to the user while it stages ransomware components in the background.

APT28 NotDoor Outlook Macro Security Bypass (via registry_set)

This rule detects Outlook security policy changes that lower the macro security Level to one and enable LoadMacroProviderOnBoot, the registry tampering APT28 performs to auto-load its NotDoor VBA backdoor at Outlook startup. Adversaries leverage these values to run malicious macros without prompts, making detection of either change important for catching mail-client persistence.