Sigma detection rules, expert-reviewed

Suspicious Modification of dMSA Managed Account Link Attributes

This rule detects directory modifications to the msDS-ManagedAccountPrecededByLink or msDS-DelegatedMSAState attributes of a delegated Managed Service Account. The BadSuccessor attack abuses these dMSA attributes to inherit privileges from a targeted account and escalate in Active Directory. Changes to these attributes outside sanctioned administration indicate an escalation attempt.

Suspicious winhlp32 Network Connection Indicating RemcosRAT Injection

This rule detects winhlp32.exe establishing an external network connection, behavior the legacy help viewer never performs and used in the OnlyDcRatFans intrusion as the injection host for RemcosRAT command and control. An outbound connection from winhlp32 signals injected malicious code beaconing to an attacker server.

Malicious macOS Credential Verification via dscl authonly

This rule detects use of dscl with the authonly flag to validate a captured password against the local directory service, a technique used by the AMOS stealer to confirm harvested credentials after phishing the user. Legitimate interactive use of dscl authonly is rare. This behavior indicates active credential access and verification on the host.

Malicious Kimsuky Keylogger PowerShell Functions PokDoc and InfoKey (via ps_script)

This rule detects PowerShell script content containing the PokDoc and InfoKey function names used by the Kimsuky implant observed against Japanese organizations. These function names are implant-specific keylogging and document-collection routines, so their presence in scriptblock logs indicates hands-on infostealer activity.

RedCurl QWCrypt Ransomware Execution with Hyper-V Targeting Flags

This rule detects the QWCrypt ransomware binary launched with its distinctive command line flags that target Hyper-V virtual machines while excluding gateway hosts and disabling shadow copies during encryption.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs. LockBit clears event logs during deployment to erase evidence of its activity and hinder incident response, so a log-clear command is a strong defense-evasion indicator.

Malicious Remote Process Creation via WMIC Node

This rule detects wmic invoking process call create against a remote node which the ALPHV actor used to launch payloads on other hosts during lateral movement and this matters because remote process creation through wmic is a well established lateral movement primitive that is uncommon in day to day administration and warrants scrutiny.

Malicious APT-C-60 COM Hijack via SpyGlace CLSID InProcServer32 (via registry_set)

This rule detects registry modification of the InProcServer32 value for the specific CLSIDs abused by APT-C-60 for COM hijacking to load the SpyGlace backdoor. Pointing these class identifiers at an attacker DLL provides stealthy persistence and execution whenever the hijacked COM object is instantiated.

Malicious Defender Exclusion for Executables via Add-MpPreference (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion by file extension through Add-MpPreference with ExclusionExtension, the defense-evasion behavior used by the Lua-based loader targeting the education and gaming sectors to exempt executable and library files from scanning. Adversaries leverage this to blind Defender across whole drive extensions before dropping payloads, making early detection critical for stopping the loader before persistence and C2 are established.

Malicious Windows Event Log Clearing via Wevtutil

This rule detects wevtutil being used to clear the Security or System event logs, an anti-forensic action that destroys traces of intrusion activity. The Gentlemen ransomware clears these logs to hinder incident response. Detecting the log wipe exposes deliberate defense evasion during a ransomware attack.

Malicious DPAPI Credential Decryption via PowerShell ProtectedData Unprotect

This rule detects PowerShell invoking the DPAPI ProtectedData Unprotect method to decrypt secrets from the current user context. SocGholish operators used this to unprotect stolen browser credential material after staging it locally. This lets attackers recover plaintext passwords without touching disk artifacts that alert defenders.

Malicious FakeSG Scheduled Task VCC_runner2 NetSupport Loader (via process_creation)

This rule detects creation of a scheduled task named VCC_runner2 via schtasks. The FakeSG campaign registers this task to run a script chain that unpacks and launches a NetSupport RAT, so this distinctive task name indicates the fake-update loader persisting on the host.

Suspicious macOS Quarantine Bypass via xattr and chmod After curl Download

This rule detects a shell one liner that downloads a payload with curl then strips the com.apple.quarantine attribute and makes it executable as used by UNC5142 macOS ClickFix delivery. This behavior bypasses Gatekeeper so downloaded malware can run without user prompts.

Malicious SharePoint ToolShell Exploitation Request to ToolPane (via webserver)

This rule detects the exploitation request pattern for the SharePoint ToolShell vulnerabilities, a POST to the ToolPane endpoint in edit display mode with a spoofed SignOut referer used to bypass authentication. This request pattern corresponds to CVE-2025-49706 and CVE-2025-49704 exploitation rather than legitimate access.

Malicious Hidden Local Account via Winlogon SpecialAccounts UserList

This rule detects modification of the Winlogon SpecialAccounts UserList registry key which hides a local account from the Windows logon screen, a defense-evasion technique used alongside AnyDesk abuse to conceal an attacker-created administrator account. Writing to this key is almost never legitimate and indicates deliberate account hiding.