Sigma detection rules, expert-reviewed

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects in the wild exploitation of Fortinet FortiWeb CVE-2025-64446 where a request to the cmdb API traverses the path to the internal fwbcgi handler to bypass authentication and create administrative users. The combination of the cgi-bin fwbcgi target and directory traversal is a reliable exploitation marker.

Malicious Event Log Service Disabled via sc.exe (Soco404 Cryptomining)

This rule detects sc.exe stopping the Windows event log service, an anti forensic action used by the Soco404 cryptomining campaign to blind defenders. It is important because stopping event logging removes the primary source of endpoint telemetry during active intrusion.

Malicious macOS LaunchDaemon Persistence Masquerading as Finder Helper

This rule detects creation of a LaunchDaemon property list named com.finder.helper.plist, the persistence artifact dropped by the AMOS stealer masquerading as a legitimate Finder helper. Registering this plist establishes root-level persistence that survives reboots. The fake Finder helper label is a known AMOS masquerade and is not a genuine Apple daemon.

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

This rule detects command lines invoking SharpDPAPI machine masterkey or machine credential functions, the tooling used to recover machine-scoped DPAPI keys and ultimately active ADFS signing keys in the observed intrusion. Adversaries extract these keys to decrypt protected secrets and forge SAML tokens for cloud access, so SharpDPAPI machine operations are a high-fidelity credential access indicator.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Malicious TeamPCP durabletask Infection Markers and Rope State (via file_event)

This rule detects the .sys-update-check cache infection markers and the .rope_state SSM instance state file written by the trojanized durabletask PyPI payload to track infection and staged AWS SSM targets. These fixed hidden files indicate the TeamPCP implant is installed and enumerating cloud resources.

Suspicious BunnyLoader Keylog Capture File in AppData Temp (via file_event)

This rule detects creation of files matching the ADE_ prefix text file pattern in the local AppData Temp directory, the naming scheme BunnyLoader uses to stage captured keystrokes before exfiltration. Writing keylog output under this predictable path reflects the loader collection module in operation, marking active credential and data theft.

Malicious Chrome Extension Sideload via --load-extension from User-Writable Path (via process_creation)

This rule detects a Chromium-based browser launched with the --load-extension flag pointing to a user-writable AppData or Public directory. The Ducktail campaign drops a malicious extension into the Chrome User Data folder and injects it through a LNK shortcut using --load-extension to steal session cookies and hijack business accounts, so this command line indicates unauthorized extension loading.

ResolverRAT Loader DLL Sideloading via hpreader (via image_load)

This rule detects the legitimate signed hpreader.exe loading a DLL from a user-writable directory, the DLL sideloading behavior used by the ResolverRAT loader to reflectively execute its .NET payload in memory under a trusted process. Adversaries leverage sideloading against a signed binary to run malicious code with a benign parent, making early detection critical for surfacing the loader before registry persistence and encrypted C2 are established.

SharePoint ToolShell Exploitation via ToolPane.aspx DisplayMode Edit (via webserver)

This rule detects requests to the SharePoint ToolPane.aspx endpoint with the DisplayMode Edit parameter, the exploitation vector for the ToolShell chain CVE-2025-53770 and CVE-2025-53771 that abuses Referer header handling to reach authenticated functionality without authentication. Adversaries use this request to deploy a webshell and steal ASP.NET machine keys.

Malicious Network Login Performed to Multiple Targets (via security)

This rule detects would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.

Data Exfiltration to WebDAV Share via curl Upload

This rule detects curl uploading a file to a remote WebDAV endpoint using the upload flag. RedCurl uses this method to stage stolen data and logs to attacker controlled Nextcloud style cloud storage.

Malicious COM Hijack of PSFactoryBuffer InprocServer32

This rule detects modification of the InprocServer32 value under the CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27} PSFactoryBuffer key in the per-user registry hive, a COM hijack used by RomCom for persistence and execution after WinRAR exploitation. Redirecting this COM server class to an attacker DLL causes malicious code to load when the COM object is instantiated.

Malicious NTLM Downgrade Attack - Reg via SYSMON (via registry_set)

This rule detects modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.

Malicious Cicada3301 Ransomware Locker Execution via Command Line Key (via process_creation)

This rule detects execution of the Cicada3301 ransomware locker binary with its command-line decryption key argument, which the Repellent Scorpius affiliate launched remotely through PsExec to encrypt hosts. Passing the encryption key on the command line is characteristic of this Rust-based locker and indicates active ransomware deployment.