Sigma detection rules, expert-reviewed

Suspicious LaunchDaemon Load via launchctl

This rule detects loading and enabling of a launchd job via launchctl with the -w flag. This behavior matches macOS lateral movement and persistence tradecraft where attackers install malicious plist based services to maintain access. While used by legitimate administration, unexpected launchctl load activity on endpoints can indicate persistence installation and should be reviewed.

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

This rule detects web requests to the shell and file API endpoints used by the CurKeep backdoor for command-and-control in the Stayin Alive campaign. The fixed api shell and api file URI paths reflect the backdoor tasking channel and help surface implant traffic in proxy logs.

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

This rule detects a script or process accessing browser and cryptocurrency wallet credential stores for Chrome, Edge, MetaMask, Phantom and 1Password, matching the INVISIBLEFERRET JavaScript stealer that packages stolen data into a ZIP for exfiltration. This credential and wallet harvesting supports DPRK financial theft in the EtherHiding campaign.

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

This rule detects AWS Organizations and account enumeration API calls that map the blast radius of compromised access keys. Unit 42 observed this cloud service discovery during the SugarCRM incident where stolen credentials were used to survey the target environment before resource abuse, so alerting is warranted when these calls come from unexpected principals.

Suspicious Domain Admins Group Enumeration via net.exe (via process_creation)

This rule detects enumeration of the Domain Admins group with net localgroup and the /domain switch, used for privilege-mapping discovery during a compromised-vendor intrusion. Attackers query privileged group membership to identify high-value accounts before lateral movement. While administrators occasionally run this, its appearance alongside credential dumping is high signal.

Possible Check Point SmartConsole Token Redemption Endpoint Access (via proxy)

This rule detects HTTP requests to the SmartConsole /cpmws/LoginSvcRemote token redemption endpoint. Rapid7 documented abuse of this SOAP endpoint to redeem forged SSO tokens as part of the CVE-2026-16232 authentication bypass against Check Point management servers. Legitimate SmartConsole clients also reach this endpoint so alerts should be correlated with unexpected source hosts or forged application token audit events.

Suspicious Wscript Executing UN VBS Cleanup Script via Command Line (via process_creation)

This rule detects wscript.exe executing a VBScript named UN.vbs, the cleanup component used by the Parallax RAT to remove infection artifacts. It is associated with the Parallax RAT campaign reported by Uptycs. Attackers run this script to erase traces after establishing access, so the execution is a useful indicator of post-infection cleanup activity.

Possible Linux Hardware Reconnaissance via Dmidecode Baseboard Query

This rule detects execution of dmidecode requesting baseboard information, a host-fingerprinting step used by the Prometei botnet alongside reads of /proc/cpuinfo. Malware profiles infected systems this way before cryptomining. While inventory tools may use dmidecode, its use by unexpected parents warrants review.

Possible Task Manager Access Indicator for Potential LSASS Dump (via process_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Possible Mamba 2FA AiTM Phishing URL Pattern

This rule detects HTTP requests matching the Mamba 2FA adversary in the middle phishing URL structure of a single letter path segment m, n or o followed by a query string carrying a Base64 encoded victim token. Mamba 2FA relays Microsoft 365 credentials and session cookies through this pattern to bypass multifactor authentication. Because the pattern is broad it should be corroborated with the known relay domains before action.

Renamed Grandoreiro DLL Sideloading via mingwm10 from User-Writable Path (via image_load)

This rule detects a process loading a mingwm10 runtime DLL from a user-writable directory, the side-loading vehicle used by the Grandoreiro banking trojan in its Brazil-to-Mexico campaign where a renamed Duplicate Files Finder binary loads a malicious mingwm10 DLL. Adversaries drop the trojanized runtime beside a relocated legitimate binary to execute under a trusted process. Loads from download or temp paths rather than an install directory are anomalous.

Possible Noodlophile Persistence via Run Key Launching Python Through cmd (via registry_set)

This rule detects a Registry Run key whose value launches a Python interpreter through cmd.exe, the persistence behavior used by the evolved Noodlophile stealer to re-run its Python payload at logon after DLL-sideloading delivery. Adversaries leverage a Run key that chains a command shell into an interpreter so the stealer survives reboots, making detection useful for surfacing persistence before repeated credential and browser-data theft.

Suspicious Expensive LDAP Query Reconnaissance

This rule detects Directory Service event 1644 recording expensive or inefficient LDAP search queries against a domain controller. This behavior matches LDAP-based reconnaissance where attackers issue broad filters to enumerate users, groups, and computers. A burst of expensive LDAP queries from unusual sources indicates active directory enumeration and should be correlated with the requesting host.

Suspicious Linux Host Reconnaissance via Whoami and Uname by UAT-7290

This rule detects a shell one-liner echoing the current user together with kernel and machine details from uname. UAT-7290 uses this command to profile compromised Linux hosts during initial access. Combined user and system enumeration is a common precursor to deploying tailored malware.