Sigma detection rules, expert-reviewed

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

This rule detects a malicious cron entry that uses wget piped to bash observed during exploitation of the GlobalProtect CVE-2024-3400 vulnerability. Attackers established persistence and staged tooling through /etc/cron.d/update. Download-and-execute cron jobs provide resilient footholds on compromised appliances.

Suspicious Java Runtime Execution from LocalAppData Staging Folder

This rule detects javaw executing from a user LocalAppData staging directory used by the Xeno stealer. The malware bundles a private Java runtime under Java and Microsoft GameDVR paths to run its malicious JAR while blending in with normal directories.

Malicious Active Directory Database Dump via ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked to create a full Install-From-Media snapshot of the Active Directory database, the credential-dumping step observed on domain controllers prior to NTDS.dit exfiltration. Adversaries leverage ntdsutil to extract every domain hash in one operation, making detection of the IFM and full snapshot subcommands critical for catching domain-wide credential theft.

Malicious Cloud Instance Metadata Credential Access via Command Line Tool on Linux

This rule detects curl or wget requesting the AWS instance metadata IAM security credentials endpoint which the TeamTNT Doppelganger credential stealer uses to harvest cloud role credentials from the IMDS for lateral movement into the victim AWS account.

BitLocker Feature Installation via ServerManagerCmd or PowerShell (via process_creation)

This rule detects on-demand installation of the BitLocker Windows feature through ServerManagerCmd or Install-WindowsFeature, the enabling step ShrinkLocker performs on systems where BitLocker is absent before hijacking it to encrypt drives. Adversaries leverage the native BitLocker feature to lock victim data without dropping a custom encryptor, so this behavior warrants review on hosts where BitLocker deployment is unexpected.

Suspicious Linux PAM Module pam_unix Modification via file_event

This rule detects creation or modification of the pam_unix.so authentication module that malware replaces to log SSH passwords or accept a universal backdoor password. Unit 42 documented Linux malware tampering with pam_unix.so and related PAM shared objects to subvert authentication, so unexpected writes to this module warrant investigation.

Malicious Reverse Shell via socat

This rule detects socat spawning a shell over a TCP connection, a reverse-shell pattern used by the Outlaw Linux malware for remote access. socat invoked with both an EXEC or SYSTEM shell handler and a TCP endpoint is characteristic of interactive command-and-control rather than benign relaying.

Suspicious Scheduled Task Creation Running DLL from ProgramData

This rule detects schtasks.exe creating a scheduled task whose action invokes rundll32 against a DLL located in ProgramData, matching the persistence mechanism of the WARMCOOKIE backdoor. Adversaries register such tasks so the loader runs automatically after reboot or logon.

Malicious PostgreSQL COPY FROM PROGRAM Command Execution via Managed Cloud Database (via process_creation)

This rule detects the PostgreSQL server process spawning a shell or command utility, the primitive Wiz Research abused through COPY FROM PROGRAM in GCP Cloud SQL and Azure Database for PostgreSQL to run operating-system commands and open reverse shells. Since the database engine should not launch interpreters, such child processes indicate exploitation of database privileges for code execution and container escape.

Malicious VenomRAT Offline Keylog File Creation via file_event

This rule detects creation of the DataLogs_keylog_offline keystroke capture file that VenomRAT writes under the user AppData MyData directory. This hardcoded artifact path marks active offline keylogging by the VenomRAT payload delivered through the fake CVE-2023-40477 proof-of-concept, indicating credential and data theft on the host.

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

This rule detects forfiles.exe enumerating win.ini and using its command flag to launch PowerShell and mshta, matching the PEAKLIGHT LNK-driven infection chain that abuses forfiles as a proxy execution binary. This technique launches a memory-only downloader while evading direct process lineage detection.

Suspicious Application Shim Database Registration via Registry Set

This rule detects registration of a custom application shim database under the AppCompatFlags Custom and InstalledSDB registry keys, the persistence and injection technique detailed in the SHIM Me What You Got research abusing sysmain.sdb. Adversaries install malicious shims to inject code and persist, so unexpected SDB registrations warrant review.

Malicious Remote Process Execution From an SMB Admin Share (via process_creation)

This rule detects a process whose image is executed directly from a remote SMB administrative share (a UNC path into ADMIN$ or C$), a lateral-movement pattern used to run tools copied to a remote host. Lateral movement over admin shares is featured in the Red Canary Threat Detection Report and underpins many hands-on-keyboard intrusions and ransomware deployments. Detecting execution from a UNC admin-share path surfaces the pivot as it happens.

Malicious LummaC2 Stealer C2 Endpoint Beacon via Proxy

This rule detects HTTP requests to the LummaC2 command-and-control endpoints /c2conf and /c2sock used by version 4.0 of the stealer. These fixed URI paths handle configuration retrieval and data exfiltration. Detecting them identifies infected hosts communicating with LummaC2 infrastructure.

Malicious Volt Typhoon Port Proxy Configuration via Netsh (via process_creation)

This rule detects netsh being used to add an IPv4 to IPv4 port proxy rule, a living off the land relay technique Volt Typhoon uses to tunnel traffic through compromised network devices and hosts. This intrusion set targets critical infrastructure for stealthy lateral movement, so an interactive portproxy add almost always reflects adversary staged pivoting rather than administration.