Sigma detection rules, expert-reviewed

Malicious Cron Execution of Binary from tmp Directory on Linux (via process_creation)

This rule detects cron launching an executable located under /tmp such as /tmp/kernal, the minute-interval persistence used by threat actors exploiting React2Shell (CVE-2025-55182) on Linux hosts. Scheduling a world-writable /tmp binary via cron provides resilient re-execution of dropped backdoors after post-exploitation.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Suspicious Masqueraded DAT File Loader Chain in Loader Stage (via process_creation)

This rule detects command lines referencing the SecureBootUEFI.dat, Service.dat, cn.dat or sp.dat staging files used by APT-C-60 in the SpyGlace deployment chain. These .dat-named artifacts are sequentially decoded loaders masquerading as data files to conceal the final backdoor payload.

Suspicious git.exe Executing Non-Repository Script Payload (via process_creation)

This rule detects the legitimate git.exe being used to execute an unrelated script or data file such as IPML.txt, the living-off-the-land technique used by APT-C-60 to run the SpyGlace loader chain. Abusing a signed git binary as an execution proxy lets the actor run staged payloads while evading binary-based controls.

Suspicious MSBuild Execution of Inline Payload (via process_creation)

This rule detects execution of MSBuild.exe, the trusted developer utility abused by MirrorFace to compile and run malicious inline tasks from XML project files. Attackers use MSBuild as a trusted proxy to execute code and evade application controls outside of a normal build pipeline.

Suspicious Service ACL Hardening via sc.exe sdset (via process_creation)

This rule detects use of sc.exe with the sdset argument to rewrite a service security descriptor, a defense-evasion step used by MirrorFace to harden the ACL of its NOOPDOOR service against inspection and removal. Restricting service access via SDDL is used to protect malicious persistence from defenders.

Malicious n8n Expression Sandbox Escape child_process Payload

This rule detects HTTP request content carrying an n8n expression sandbox escape that reaches the Node.js child_process module through process mainModule require, the exploitation payload for CVE-2025-68613 used by the Zerobot botnet. The chained references break out of the expression evaluation context to run arbitrary commands. These strings together in request data indicate an exploitation attempt against the n8n platform.

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

This rule detects inbound HTTP requests carrying the X-siLock-Step1 or X-siLock-Step3 headers used by the MOVEit Transfer exploit toolkit. These custom headers drive the CVE-2023-34362 exploitation flow and indicate an attacker interacting with the human2.aspx web shell to exfiltrate data.

Malicious Text4Shell Apache Commons Text Interpolation Payload in HTTP Request

This rule detects HTTP requests containing Apache Commons Text StringSubstitutor interpolation payloads such as script, dns or url lookups used to exploit CVE-2022-42889 (Text4Shell) for remote code execution. Attackers embed these interpolation strings to trigger arbitrary command execution on vulnerable servers. Presence of these lookup prefixes in request data is a strong exploitation indicator.

Suspicious VBScript Persistence in CurrentVersion Run Key

This rule detects a CurrentVersion Run autorun value whose data references a script interpreter or inline VBScript, a persistence technique in which adversaries register a scripting payload to execute at logon. Storing wscript, mshta or vbscript logic in a Run key lets fileless or lightly obfuscated code survive reboots. Legitimate autorun entries rarely embed script keywords of this kind.

Suspicious VBScript Code Stored in CurrentVersion Registry Value

This rule detects registry values written under a CurrentVersion key that carry VBScript or scripting-object keywords such as Execute, Shell.Application or CreateObject. Adversaries including Nobelium via the Sibot malware hide executable script inside registry values to evade file-based detection and later run it through a script interpreter or rundll32. Storing script logic in registry data is unusual for legitimate software and indicates fileless staging.

Suspicious Remote Desktop Enablement via Registry By Ransomware

This rule detects the registry change that clears fDenyTSConnections to enable inbound RDP on a host. The Qilin ransomware group flips this key to open a Terminal Server access path for lateral movement. Enabling RDP on a workstation that normally has it disabled is a strong pre-encryption footprint.

Suspicious VBScript Payload Stored in CurrentVersion Registry Value (via registry_set)

This rule detects registry values written under HKCU or HKLM CurrentVersion that contain VBScript execution keywords such as Execute, vbscript or Shell.Application. Actors including Nobelium stash script payloads in non-Run CurrentVersion values to hide fileless persistence outside the commonly scrutinized Run subkeys.

Suspicious Browser Extension Force-Install via Registry (via registry_set)

This rule detects registry writes to the browser ExtensionInstallForcelist policy that silently force-install an extension into Chrome or Edge. PrivateLoader pushes unwanted extensions this way so the browser loads attacker code without user consent. Programmatic force-install entries are a stealthy persistence and monetization mechanism worth reviewing.