Sigma detection rules, expert-reviewed

Suspicious PlugX Persistence via CanonPrinter Run Key (via registry_set)

This rule detects creation of a CurrentVersion Run registry value named CanonPrinter that points to a sideloading executable in a user AppData Roaming directory. UNC6384 used this Run key to persist the Canon binary that sideloads PlugX across reboots.

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

This rule detects a PowerShell one-liner enumerating all event logs and clearing them through the EventLogSession GlobalSession ClearLog method. Qilin ransomware operators used this to wipe forensic evidence across every log on compromised hosts.

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

This rule detects execution of a binary named FortiEndpoint_Patch.exe, the EKZ infostealer masqueraded as a Fortinet endpoint patch. It was delivered after FortiClient EMS exploitation to harvest browser credentials and cookies.

Suspicious BeyondTrust Bomgar Process Spawning Remote Access Client (via process_creation)

This rule detects a BeyondTrust Bomgar process spawning a renamed SimpleHelp remote access binary. Operators abused the CVE-2026-1731 command-execution flaw to deploy SimpleHelp under the SYSTEM account as a secondary remote access foothold.

Malicious NTDS Extraction via ntdsutil IFM (via process_creation)

This rule detects use of ntdsutil to create an Install From Media copy of the Active Directory database. Qilin ransomware operators ran ntdsutil with the ifm create full arguments to extract the NTDS database and registry hives for offline credential harvesting.

Suspicious MeshAgent Persistence via Scheduled Task MeshUserTask (via process_creation)

This rule detects creation of a scheduled task named MeshUserTask used to persist the MeshCentral MeshAgent remote management binary. Intrusion operators in the Anubis and Qilin ransomware campaigns installed MeshAgent for covert remote access and registered this task to survive reboots.

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

This rule detects execution of the cloudflared client establishing an outbound Cloudflare Tunnel. Operators behind the Anubis ransomware campaign dropped cloudflared to Windows and NAS hosts and ran it with tunnel and token arguments to create a persistent encrypted command and control channel that bypasses inbound firewall controls.

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

This rule detects the Windows tar utility extracting archive files with an unusual .ta extension. UNC6384 delivered PlugX by extracting rjnlzlkfe.ta and krnqdyvmlb.ta archives with tar into the Temp directory before executing the sideloaded Canon binary.

Suspicious Microsoft Defender Path Exclusion of User Directories (via process_creation)

This rule detects Add-MpPreference adding a Microsoft Defender exclusion path for the AppData Roaming, AppData Local or ProgramData directories. GPUGate and similar malware families exclude these user-writable staging locations before dropping payloads.

Suspicious RustDesk Remote Access Service Installation via sc (via process_creation)

This rule detects creation of a Windows service that launches RustDesk with an imported configuration. Akira ransomware operators installed RustDesk as an auto-start service using sc create to maintain unattended remote access to compromised hosts.

Malicious Windows Defender Tampering via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling multiple Microsoft Defender protection features in a single Set-MpPreference invocation. Akira ransomware operators ran this command to disable real-time, behavior, script and archive scanning before deploying tooling and the encryptor.

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

This rule detects a non-interactive PowerShell process launched with an encoded command from a command shell. This staging pattern was observed during exploitation of Cleo managed file transfer software to decode and run the next-stage payload for the Cleopatra backdoor.

Malicious Service Creation Pointing to Public Data File via sc (via process_creation)

This rule detects creation of a Windows service whose binary path points to a .dat file staged under the Users Public directory. Operators exploiting ActiveMQ created a service named windowDefenSrv referencing a public payload file to gain persistence.

Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package fetched from a remote HTTP URL where the payload uses an image file extension. Operators exploiting CVE-2023-46604 delivered ransomware as MSI files named with a .png extension via msiexec quiet install.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.