Sigma detection rules, expert-reviewed

Suspicious Kernel Module Load via insmod on Linux (via process_creation)

This rule detects insmod being used to load a kernel object module on Linux, a technique attackers use to install rootkits at the kernel level. Loadable kernel module rootkits hide processes, files, and network activity from userland tooling. Detecting insmod of a .ko module surfaces potential kernel-mode persistence and evasion.

Suspicious Go HTTP Client User Agent via Proxy

This rule detects outbound web requests carrying the default Go HTTP client user agent, which Peach Sandstorm used from Azure infrastructure during password spray attacks against target tenants. The user agent is a weak but useful signal that can highlight automated credential-guessing traffic when correlated with failed authentication.

Malicious VoidLink Rootkit Dropper Artifacts via Filesystem (via file_event)

This rule detects the creation of VoidLink dropper artifacts prefixed with vl in temporary and shared memory directories on Linux hosts. The VoidLink rootkit stages its components as hidden vl_ files under /tmp and /dev/shm before loading its kernel module. Files matching this naming pattern indicate rootkit staging activity.

Suspicious msxsl Execution with Text Script Dropper

This rule detects the msxsl utility being used to process a txt file as a script transformation. More_eggs operators abused msxsl with txt hosted JScript droppers to execute code outside normal script interpreters. This LOLBIN abuse bypasses application controls that only watch common scripting hosts.

Malicious Mirage Kitten C2 Communication via Keyboard-Walk URIs (via proxy)

This rule detects HTTP requests to the distinctive keyboard-walk URI paths used by Mirage Kitten malware for command-and-control against Middle East and Africa targets. These fixed, non-dictionary URI stems are strong C2 indicators and their presence in web traffic points to active beaconing from a compromised host.

Suspicious C2Looper Shell Output Artifact File Creation (via file_event)

This rule detects creation of the c2_out.txt file that the first version of C2Looper uses to capture the output of shell commands before exfiltrating it. This hardcoded output filename is characteristic of the backdoor.

Suspicious VBScript Launcher Execution via Wscript for Mining Operation (via process_creation)

This rule detects wscript executing the sysdata.vbs launcher used by the Monero mining operation to stage its payload and injection routine. Observed in the Elastic Security Labs fake-installer campaign where sysdata.vbs kicks off process injection into conhost or explorer to run the XMRig miner covertly.

Suspicious Plink SSH Tunnel Used for Data Exfiltration

This rule detects the PuTTY plink client invoked with port forwarding and non-interactive SSH options consistent with tunneling and exfiltration. Microsoft observed Marbled Dust using plink to exfiltrate collected data over SSH from Output Messenger victims. Command-line SSH tunneling by an espionage actor over an encrypted channel is used to bypass egress monitoring, so this pattern warrants investigation.

Suspicious WMIC Remote Process Creation Installing MSI via Command Line

This rule detects wmic invoking process call create to launch msiexec, a WMI-based execution technique used after Citrix Bleed exploitation to deploy the LockBit loader. Combined use of process call create with msiexec is rarely legitimate on endpoints. Detecting it exposes remote or local code execution via WMI.

Suspicious New Member Added to an Exchange Administration Group - High Risk (via security)

This rule detects scenarios where a new member is added to a sensitive group related to Exchange server.

Suspicious Medium Risk Active Directory Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed.

Suspicious Data Exfiltration to Webhook.site via Command Line (via process_creation)

This rule detects PowerShell or curl reaching webhook.site, the exfiltration channel used by attackers after exploiting WSUS via CVE-2025-59287 to send reconnaissance output offsite. The free request-capture service receives whoami and network discovery results. Detecting this outbound call exposes staged data theft following server exploitation.

FalseFont Backdoor Persistence via Registry Run Key Pointing to User-Directory Binaries (via registry_set)

This rule detects a registry Run key value whose data points to the host.exe, broker.exe, or System.exe binaries dropped into user-profile directories by the FalseFont backdoor used by the Peach Sandstorm threat actor. Adversaries register these autostart entries to survive reboot, making detection useful for catching persistence of the espionage implant.

Suspicious Extexport DLL Side-Loading Execution

This rule detects execution of the Internet Explorer Extexport.exe utility which loads mozcrt19, mozsqlite3 or sqlite3 DLLs from its working directory. In the WithSecure Code Execution and Persistence Lab 1 the Astaroth chain drops malicious DLLs of these names next to Extexport.exe to achieve DLL side-loading. Attackers proxy code execution through this signed LOLBin to run their payload under a trusted process.

Suspicious Service Persistence via InstallUtil with Masqueraded Service Name

This rule detects InstallUtil.exe referencing the nhdService or WinDefUpd service names used by the ShellClient RAT in Operation GhostShell for persistence. Attackers install these masqueraded services so the RAT survives reboots and blends in with legitimate update services. The pairing of the InstallUtil proxy binary with these specific service names is a strong GhostShell indicator.