Sigma detection rules, expert-reviewed

Suspicious Python Process Establishing PostgreSQL Command and Control Channel

This rule detects a Python interpreter initiating outbound connections to the PostgreSQL service port. A commodity stealer abuses a PostgreSQL database as its command-and-control transport, storing victim registration and retrieving tasking through SQL queries instead of HTTP.

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

This rule detects the signed Apple iTunesHelper binary loading a CoreFoundation DLL from a non standard directory. DarkGate abuses DLL search order hijacking by placing a malicious CoreFoundation.dll next to a legitimate Apple executable to proxy execution of its packed payload.

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

This rule detects modification of the ApplicationBoundEncryptionEnabled policy value under the Google Chrome or Microsoft Edge policy keys, the registry-based bypass Red Canary documented stealers using to weaken app-bound cookie encryption. Disabling this protection removes a key defense against cookie theft, so changes to this policy value warrant review for stealer activity.

Malicious Registry Run Key Persistence Using Scarlet Goldfinch OFFICE and DIVXX Values (via registry_set)

This rule detects creation of HKCU Run key values named OFFICE or DIVXX, the specific autorun entries Red Canary attributed to Scarlet Goldfinch for persisting its NetSupport Manager deployment. These named values are non-standard for legitimate software, so their appearance under the CurrentVersion Run path indicates adversary persistence.

Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)

This rule detects a PowerShell download cradle that pulls a remote payload with Net.WebClient DownloadString and pipes it directly to IEX for in-memory execution, the tmp.48 stager observed in the Confluence exploit ransomware campaign by Red Canary. This pattern fetches and runs code without touching disk and is a common loader technique across intrusions.

Suspicious PowerShell Reflective Assembly Load With Registry Property Read via Script Block (via ps_script)

This rule detects PowerShell that reads data from a registry value and reflectively loads a .NET assembly in memory, the obfuscated in-memory loading behavior Gootloader uses per Red Canary. Reflective assembly loading combined with registry-stored payloads avoids writing an executable to disk, so this combination is a strong indicator of fileless second-stage execution.

Suspicious Remote Access Tool User Agent in Outbound Traffic via Proxy

This rule detects outbound HTTP requests carrying the NetSupport Manager or JWrapperDownloader user agents, network fingerprints of remote access tooling used during intrusions. Because these agents accompany download and command-and-control traffic for tools frequently abused as RATs, their presence in proxy logs indicates remote access tool activity that should be validated against sanctioned software.

Suspicious Atera Agent Silent Onboarding via Process Creation

This rule detects the AteraAgent remote monitoring binary launched with init-settings and an embedded integrator or company key, a command line used to silently onboard a host into an attacker-controlled Atera tenant. Adversaries abuse legitimate RMM agents like Atera for persistent remote access and command execution, so unattended agent onboarding outside sanctioned IT deployment is a meaningful signal.

Suspicious Archive Extraction From AppData Staging Folder via Process Creation

This rule detects tar extracting an archive from a numeric AppData Local staging folder, the unpacking step in the Scarlet Goldfinch ClickFix chain that stages the next payload. Adversaries create a short randomly named numeric directory under AppData and expand a downloaded archive there before execution, so tar activity in this location signals payload staging.

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

This rule detects curl or wget command lines that reference the AWS credentials file, the exfiltration step used by malicious OpenClaw agent skills to steal cloud keys. Adversaries read the .aws/credentials file and post it to attacker infrastructure, so a web client touching this path indicates active credential access and exfiltration.

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

This rule detects the Bun JavaScript runtime spawning the TruffleHog secret scanner, a behavior chain used by the Shai-Hulud worm to harvest credentials from developer and CI environments. Adversaries abuse the legitimate TruffleHog tool during package install hooks to locate secrets before exfiltrating them, so this parent-child pairing is a strong indicator of automated credential collection.

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

This rule detects registration of a rogue self-hosted GitHub Actions runner using the runner.listener binary with unattended flags and the SHA1HULUD name marker tied to the second-wave Shai-Hulud supply chain worm. Attackers register malicious runners to obtain persistent code execution inside CI/CD pipelines and spread across repositories, enabling mass credential theft and downstream package poisoning.

Malicious Hidden Virtual Machine Launched via QEMU for Persistence

This rule detects QEMU started with a qcow2 disk image and a user mode network device which adversaries use to run a concealed virtual machine on the host to evade endpoint detection and maintain persistence. Running malicious tooling such as Sliver inside an attacker supplied VM hides its activity from host based sensors. Detecting these QEMU arguments surfaces the bring your own virtual machine technique.

Malicious Data Exfiltration via curl with Stealer Specific BuildID Header

This rule detects curl invoked with the custom BuildID or buildid HTTP header used by the Atomic and Odyssey macOS information stealers to exfiltrate collected data to their command and control servers. These distinctive headers identify the stealer build during the collection upload. Detecting them surfaces active credential and data theft on macOS endpoints.

Suspicious ScreenConnect Remote Access Binary Running Under a Renamed Executable

This rule detects a process whose original filename identifies it as ScreenConnect or SimpleHelp remote access software but whose on disk name has been changed which indicates masquerading to evade detection during phishing driven RMM abuse. Renaming remote support tools helps adversaries hide interactive access from defenders. Detecting the mismatch surfaces disguised remote access tooling.