Sigma detection rules, expert-reviewed

Malicious Stealth Soldier C2 User-Agent (via proxy)

This rule detects outbound web requests carrying the hardcoded Stealth Soldier user-agent string used by the Stealth Soldier backdoor in espionage attacks across North Africa. This static, tool-specific user-agent is a distinctive command-and-control fingerprint that legitimate clients do not present.

Suspicious Rogue WordPress REST Route morning/v1 (via webserver)

This rule detects requests to a rogue REST route morning/v1 registered by the wp2shell web shell to execute commands via a base64 parameter passed to passthru. Access to this attacker-defined route indicates an active web shell on the WordPress host. The specific route name is characteristic of this implant.

Malicious User Browser Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.

Suspicious macOS Local Credential Validation via dscl authonly

This rule detects use of the Directory Service command line tool dscl with the authonly option to validate a local account password without producing a login session. The MacSync stealer described by Huntress used this technique to confirm harvested credentials and to brute force the local user password. Legitimate use is rare, so scripted or non-interactive invocations should be treated as credential-access activity.

Malicious AutoHotkey Script Execution From ProgramData (via process_creation)

This rule detects AutoHotkey.exe running an .ahk script from a subdirectory of C:\ProgramData which the DarkGate loader uses to execute its interpreted payload after a template injection chain. Abusing the legitimate AutoHotkey interpreter to run scripts from a staging directory evades script host controls and hides malicious logic.

Suspicious Unattended RMM Installer Execution via Msiexec

This rule detects installation of the LogMeInResolve_Unattended.msi package, an unattended remote-access tool installer distributed by the RMM phishing campaign to gain hands-on-keyboard access. Unattended RMM installs delivered through phishing lures are a common precursor to remote control abuse.

Suspicious PowerShell COM-Based Script Execution and HTTP Retrieval (via ps_script)

This rule detects PowerShell script content that instantiates the MSScriptControl COM object alongside ServerXMLHTTP for command retrieval. The STEADY#URSA SUBTLE-PAWS backdoor used this combination to fetch and run C2 commands.

Suspicious Data Exfiltration via TFTP Client

This rule detects execution of the TFTP client, a non-standard egress protocol abused for covert data exfiltration as described by Elastic. Adversaries use the trivial file transfer protocol to move data out over an uncommon channel that often evades web focused monitoring. TFTP is rarely used on modern endpoints so its execution warrants review for exfiltration or ingress tooling.

Suspicious Archive Staged in Web Accessible Directory via tar

This rule detects tar creating a compressed archive whose output path lands in the Ivanti EPMM web accessible directory as described by WithSecure where system files were archived to a public web path for retrieval. Staging collected data inside a web served directory is a hallmark of exfiltration over the same web channel used for initial access.

Suspicious File Content Wiping via fsutil setzerodata (via process_creation)

This rule detects fsutil being used to zero out file contents through the setzerodata operation. LockBit uses fsutil to overwrite files with zeros to frustrate recovery and forensic analysis, so this command indicates destructive impact activity.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects execution of the Rclone utility with copy or sync arguments to a configured remote. Actors in this App Installer campaign staged Rclone to exfiltrate data to cloud storage prior to Black Basta ransomware deployment.

Suspicious Executable Started from Windows Help Directory via Process Creation

This rule detects execution of a portable executable located in the Windows help directory which is abnormal for that folder and was used by the REF5961 intrusion set to run the RUDEBIRD loader from C\Windows\help. Attackers place binaries there to masquerade as benign system content and evade path-based scrutiny.

Suspicious Scheduled Task Executing JavaScript from Public Directory (via process_creation)

This rule detects creation of a scheduled task that executes a JavaScript file from the Users Public Downloads directory. The Caminho loader registered tasks named amandes or amandines to run a persistence script from this world-writable location every minute.

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

This rule detects a malicious cron entry that uses wget piped to bash observed during exploitation of the GlobalProtect CVE-2024-3400 vulnerability. Attackers established persistence and staged tooling through /etc/cron.d/update. Download-and-execute cron jobs provide resilient footholds on compromised appliances.

Suspicious Java Runtime Execution from LocalAppData Staging Folder

This rule detects javaw executing from a user LocalAppData staging directory used by the Xeno stealer. The malware bundles a private Java runtime under Java and Microsoft GameDVR paths to run its malicious JAR while blending in with normal directories.