Sigma detection rules, expert-reviewed

Malicious Boot Configuration Tampering via bcdedit [Intel471] #2

This rule detects bcdedit.exe used to delete boot entries or force Safe Mode via safeboot, a defense-evasion and recovery-inhibition technique used by the Iranian-aligned Handala group ahead of destructive impact. Removing boot options or rebooting into Safe Mode disables security tooling and hampers recovery. Legitimate use of bcdedit delete or safeboot outside troubleshooting is rare.

Malicious SSH authorized_keys Modification for Persistence on Appliance

This rule detects command line activity that writes to an SSH authorized_keys file, the key-based persistence mechanism observed after exploitation of the Cisco SD-WAN CVE-2026-20127 vulnerability. Adding an attacker key to authorized_keys grants durable root access and enables lateral movement between appliances. Editing authorized_keys through a shell command outside of provisioning is suspicious on an appliance.

Malicious Office Application Spawning Command Interpreter

This rule detects a Microsoft Office application such as winword.exe or excel.exe spawning a command shell or scripting interpreter, the maldoc execution chain that follows user interaction with a phishing document. Office productivity applications do not normally launch cmd, PowerShell or script hosts. This parent-child relationship indicates macro or exploit driven code execution and payload delivery.

Suspicious PowerShell Encoded Command Execution

This rule detects powershell.exe or pwsh.exe launched with an EncodedCommand argument, an obfuscation technique used to hide the actual command from simple string matching and log inspection. Encoded PowerShell is a frequent component of maldoc and post-exploitation chains highlighted in threat hunting hypotheses. While some administrative tooling uses encoded commands, their presence warrants decoding and review.

Suspicious rundll32 or mshta Proxy Execution of VBScript

This rule detects rundll32.exe or mshta.exe invoked with a vbscript protocol handler to proxy execution of Visual Basic script, the living-off-the-land method used to run VBScript that is stored in the registry or delivered inline. This technique bypasses application control by abusing a signed system binary as the script host. Such invocations have no legitimate administrative purpose.

Suspicious Office Application Spawning Script Interpreter

This rule detects Microsoft Office applications launching PowerShell, WScript, CScript or WMIC, the phishing-payload execution chain highlighted in this threat hunt. A document or spreadsheet spawning a scripting engine indicates the user enabled malicious macro content. Office products have no routine need to invoke these interpreters.

Suspicious ADFind Active Directory Reconnaissance Execution

This rule detects execution of the ADFind reconnaissance tool used in the post-exploitation toolkit deployed by the Bumblebee loader alongside Seatbelt and Procdump. Operators run ADFind to enumerate users, groups and computers across the domain before lateral movement. Presence of this tooling indicates active hands-on-keyboard discovery.

Suspicious SimpleHelp Remote Access Tool Dropped In ProgramData Root

This rule detects the SimpleHelp remote-access binary access.exe executing from the root of the ProgramData directory, the drop location used by the actors exploiting CVE-2026-1731. Deploying a legitimate RMM tool from an unusual path gives the operator persistent hands-on access after exploitation. The ProgramData-root location distinguishes the malicious deployment from a normal install.

Suspicious Bazar Network Reconnaissance Command Batch

This rule detects the net.exe view-all-shares enumeration used in the Bazar and Cobalt Strike recon batch executed by Trickbot, Qbot and Hancitor crews after landing on a host. The operator sweeps for reachable systems and shares to select lateral-movement targets. Combined with adjacent systeminfo and whoami calls this pattern marks the start of hands-on-keyboard activity.

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating domain trusts, part of the Bazar and Cobalt Strike hands-on-keyboard reconnaissance run by Trickbot, Qbot and Hancitor operators after initial access. Mapping trust relationships helps the operator plan lateral movement across the forest. Nltest trust enumeration is an early sign of post-exploitation activity.

Suspicious Microsoft Word Spawning PowerShell

This rule detects WINWORD.exe launching PowerShell, the macro-enabled document execution chain used by the profiled APT actors for initial access. A weaponized document spawning a scripting engine indicates the user enabled malicious content. Office applications have no legitimate reason to invoke PowerShell.

Malicious NTDS Extraction via Ntdsutil IFM

This rule detects ntdsutil creating an Install-From-Media snapshot, an technique the profiled APT actors use to dump the NTDS.dit domain database from a domain controller. The IFM path copies every domain credential hash in a single operation. Ntdsutil IFM runs are rare and high-value outside of documented backup jobs.

Malicious LSASS Memory Dump via Comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export against a process, the living-off-the-land technique used by the profiled APT actors to dump LSASS memory. Extracting the LSASS process image yields credentials for lateral movement without dropping a dedicated dumping tool. This command pattern has virtually no legitimate use.

Suspicious Rundll32 Execution Without Arguments

This rule detects rundll32.exe launched with no DLL or export arguments, a hollowing or injection precursor observed in the Gootloader chain. A bare rundll32 process is typically spawned to host injected code rather than to run a legitimate library export. This anomaly is a reliable indicator of process injection staging.

Suspicious PowerShell Download Cradle Writing Executable To Windows Temp

This rule detects a PowerShell process bypassing execution policy and using Invoke-WebRequest to save an executable into the Windows Temp directory. Initial access brokers use this cradle to stage tooling on freshly compromised hosts before handing off access. Writing a remote binary into a world-writable temp path and running it is a common first-stage foothold.