Sigma detection rules, expert-reviewed

Possible Process Injection into Attrib via Mispadu AutoIt Loader (via process_creation)

This rule detects attrib.exe being spawned by the AutoIt3 interpreter, which corresponds to the Mispadu loader injecting its payload into an attrib.exe process. A legitimate AutoIt application launching attrib in this way is not expected.

Malicious TeamTNT Silentbob Cryptominer Setup Script Execution (via process_creation)

This rule detects execution of the setup_c3pool_miner.sh script that the TeamTNT Silentbob campaign drops inside compromised containers to install a Monero cryptominer after discovering misconfigured Docker APIs and JupyterLab instances. Deployment of this miner setup script on a server workload indicates cryptojacking.

Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)

This rule detects the perfctl malware creating its hidden inter process communication directory /tmp/.xdiag which holds a Unix socket and state files such as the victim IP, event log and TOR data. The hidden dot prefixed directory under tmp is used to coordinate the cryptominer and rootkit and is unique to this threat.

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

This rule detects the Samsung MagicINFO application spawning cmd.exe to run reconnaissance commands such as whoami or arp, observed by Huntress following exploitation of the MagicINFO 9 server flaw. Attackers run host and network discovery immediately after gaining code execution through the vulnerable web application. Reconnaissance shells parented by the MagicINFO service indicate active post-exploitation.

Suspicious Deadglyph Rundll32 DLL Execution by Ordinal via process_creation

This rule detects rundll32.exe executing the pbrtl.dll loader by ordinal

Suspicious lmadmin License Manager DLL Sideload from Public Path via image_load

This rule detects the Schneider Electric license manager lmadmin.exe loading a DLL from the world-writable Users Public directory, the exploitation path for CVE-2024-2658. The service is coerced into loading an attacker-planted library from a writable location. This DLL hijack grants code execution in the context of the license service.

Suspicious LaunchAgent Masquerading as coreaudiod (via file_event)

This rule detects creation of a LaunchAgent property list that masquerades as the legitimate coreaudiod system daemon inside a user LaunchAgents directory. The JINX-0164 actor dropped such plists to persist a macOS implant under a trusted-looking name. A user-writable LaunchAgent named after a core system daemon is a strong sign of persistence in a false context.

Malicious LSASS Memory Dump via dllhost with comsvcs MiniDump Arguments (via process_creation)

This rule detects dllhost.exe dumping LSASS memory using comsvcs-style MiniDump arguments, the credential-theft step observed in the intrusion where a CLFS zero-day was exploited before ransomware deployment. Adversaries dump LSASS to c:\programdata to harvest credentials for lateral movement ahead of encryption, so dllhost invoking a MiniDump against lsass is a high-confidence credential-access indicator.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevated Binary (via process_creation)

This rule detects the auto-elevating binary ComputerDefaults.exe being launched by a parent other than the normal interactive shells, the User Account Control bypass the STRT cross-RAT analysis attributes to Castle RAT via a hijacked ms-settings handler. Adversaries leverage this trusted binary to elevate a malicious command without a UAC prompt, making non-interactive launches a useful indicator for review.

Suspicious Certutil Encode or Decode for Payload Obfuscation (via process_creation)

This rule detects certutil being used with the -encode or -decode options to transform files between binary and Base64 form. Threat actors exploiting Citrix NetScaler CVE-2023-4966 used certutil to stage and deobfuscate tooling while evading content inspection. This living-off-the-land use of certutil for data encoding is a common defense-evasion and deobfuscation behavior.

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

This rule detects an sshd process being launched on a high non-standard port while restricting logins to a hardcoded attacker account through the -oAllowUsers option. UNC4841 used this technique to maintain covert SSH access to compromised Barracuda ESG appliances following CVE-2023-2868 exploitation. Establishing a dedicated backdoor listener scoped to a single attacker user provides resilient remote access that blends with legitimate SSH traffic.

Suspicious Novaservice Binary Executing From Public User Directory (via process_creation)

This rule detects execution of novaservice.exe from within the public user profile Documents or Downloads directories, a masquerade used by Boggy Serpens to run implant components from a world-writable location. A service-like binary executing from a user data path rather than a protected system directory indicates a planted payload.

Malicious DarkGate hVNC Credential Stash via cmdkey

This rule detects DarkGate storing hardcoded hidden-VNC credentials with cmdkey using the SafeMode user and the darkgatepassword0 secret. This exact credential string is unique to DarkGate hVNC sessions and reliably identifies the loader establishing covert remote access.

Malicious NTDS Extraction via NetExec (via process_creation)

This rule detects the NetExec nxc binary invoking its NTDS module over SMB to extract the Active Directory database. This was used to steal domain credential hashes en masse before ransomware deployment. Bulk NTDS extraction provides every domain account hash and enables full domain takeover.

Possible FortiOS Authentication Bypass via local_access_token on WebSocket CLI Endpoint (via webserver)

This rule detects exploitation of FortiOS and FortiProxy CVE-2024-55591 where an unauthenticated request to the Node.js websocket CLI endpoint supplies a local_access_token to bypass session validation and gain super_admin access. The combination of the ws cli path and the token parameter is not seen in normal administration.