Sigma detection rules, expert-reviewed

Suspicious fsutil Symlink Evaluation Enablement (via process_creation)

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation, a step Repellent Scorpius performs before encryption so the Cicada3301 locker can traverse symlinks to reach additional data. Loosening symlink policy expands the ransomware blast radius and is rarely done outside of an attack.

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

This rule detects RegAsm, MSBuild, RegSvcs, or AutoIt3 processes referencing browser credential and cookie stores such as Login Data, key4.db, and cookies.sqlite. Microsoft observed injected Lumma Stealer code inside these hosts harvesting DPAPI-protected browser secrets. These .NET and scripting hosts have no legitimate reason to read browser credential databases, making the combination a strong credential theft indicator.

Malicious Shadow Copy Deletion via Vssadmin (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly. DarkWatchMan RAT removes shadow copies to inhibit recovery and hide its activity on the host.

FortiOS WebSocket CLI Authentication Bypass via Node.js Exploit Tooling (via webserver)

This rule detects requests to the FortiOS websocket CLI endpoints ws cli open and ws newcli open originating from a Node.js user-agent, matching the KeyPlug-linked exploit tooling for CVE-2024-23108 and CVE-2024-23109. Adversaries leverage these websocket CLI paths to bypass authentication and reach the Fortinet command interface.

Suspicious FL Studio Executable Side-Loading flengine DLL From Non-Standard Path

This rule detects the legitimate FL Studio binary fl.exe loading flengine.dll from a directory outside its normal installation path which is the DLL side-loading technique used to launch the BITSLOTH backdoor. Adversaries abuse this trusted signed executable to proxy execution of malicious code and evade defenses.

Malicious Cobalt Strike Post Exploitation Named Pipe

This rule detects creation of Cobalt Strike post exploitation named pipes following the postex prefix convention observed during the IcedID intrusion where the beacon spawned post exploitation jobs over SMB named pipes and this matters because the postex pipe pattern is a high fidelity signal of an active Cobalt Strike beacon performing credential and command tasks.

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

This rule detects a curl or wget download whose output is piped directly into a shell interpreter, the download and execute pattern the 8220 gang schedules through cron every few minutes in the Hadooken campaign to pull and run its loader. Piping remote content into a shell removes any on disk staging and is a common Linux malware behavior. It is rarely required by legitimate automation.

Suspicious Firewall Logging Disable via netsh (via process_creation)

This rule detects netsh disabling Windows firewall logging for dropped and allowed connections across all profiles. The DEEP#DOOR campaign disabled firewall logging to hide its command and control traffic.

Malicious Konni PowerShell Loader Reading Script from ProgramData via Invoke-Expression (via process_creation)

This rule detects PowerShell launched with an execution policy bypass that reads a script from the ProgramData directory and runs it through Invoke-Expression, the loader behavior of a Konni AsyncRAT LNK infection that drops d.ps1 into ProgramData. Adversaries leverage Get-Content piped into Invoke-Expression to execute a staged script while hiding the payload from the command line, making early detection critical for catching the loader before AsyncRAT deploys.

Malicious Mailbox Forwarding Rule Creation (via exchange)

This rule detects creation or modification of a mailbox rule that auto-forwards or redirects mail to an external address, a collection-and-exfiltration technique adversaries use after compromising an account to silently siphon correspondence. Malicious email rules are a recurring identity threat in the Red Canary Threat Detection Report, often following business email compromise. Detecting forwarding-rule creation surfaces data theft that victims rarely notice.

Possible GTFOBins Shell Breakout via apt Command

This rule detects the apt or apt-get package manager spawning an interactive shell, a GTFOBins technique used to escape restricted shells or escalate privileges when apt runs under sudo. Package managers do not normally launch shells, so this parent-child relationship indicates a shell breakout attempt.

Suspicious XZ Utils Backdoor Kill-Switch Environment String via process_creation

This rule detects the hardcoded kill-switch string used by the XZ Utils liblzma backdoor (CVE-2024-3094) appearing in process command lines or environment variables. The backdoor checks for this specific token to disable itself, and its presence in telemetry indicates interaction with the implanted malicious code. Investigating hosts exhibiting this string helps identify systems affected by the supply chain attack.

Suspicious Windows Event Log Clearing via wevtutil on EC2 Host

This rule detects the wevtutil utility being used to clear Windows event logs which destroys host forensic evidence. In the Wiz hybrid cloud response the attacker deleted local operating system logs on compromised EC2 Windows instances to frustrate investigation. This is important because clearing event logs is a deliberate anti-forensic action that almost never occurs during normal administration and hides earlier attacker activity.

Malicious Axios npm Compromise Windows Payload Artifacts wt.exe and 6202033 (via process_creation)

This rule detects execution of the wt.exe payload dropped in ProgramData and the numbered staging scripts 6202033.vbs 6202033.ps1 and system.bat used by the compromised axios npm package to deploy its RAT on Windows. These fixed artifact names run during or shortly after npm install and indicate an active infection beaconing every 60 seconds.

Suspicious Kubernetes API Exposure via kubectl proxy

This rule detects kubectl proxy being launched with a listening port which exposes the Kubernetes API server through an unauthenticated local proxy. Wiz identifies this as a control plane initial access vector because the proxy forwards requests using the operator credentials without further authentication. This is important because binding the proxy to a reachable interface can hand full authenticated API access to anyone who can connect to that port.