Sigma detection rules, expert-reviewed

Malicious Credential Added to an Azure AD Application (via auditlogs)

This rule detects a password or key credential being added to an Azure AD application or service principal, an account-manipulation technique that grants an attacker persistent, app-based access to a tenant. Adding application credentials is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces a stealthy tenant backdoor being created.

Possible SSTI Remote Command Execution from Web Application Process

This rule detects a web application runtime spawning reconnaissance or download shell commands, the hallmark of server side template injection reaching remote code execution. Template engines such as Jinja2 or FreeMarker are abused to run os.popen against system utilities. Detecting the abnormal child process exposes exploitation of the exposed web application.

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

This rule detects a command interpreter executing a script staged in a WinRAR temporary extraction directory named Rar$DIa. CVE-2023-38831 abuses a filename spoofing flaw so that opening a decoy document triggers execution of an adjacent script from the Rar$ temp path. This yields attacker code execution when the victim merely opens a crafted archive.

Suspicious Botnet Payload Drop to Hidden Xdiag Temp Path

This rule detects references to the hidden staging directory /tmp/.xdiag and the /tmp/httpd artifact used to drop React2Shell follow-on payloads. Attackers stage Mirai and Gafgyt mipsel botnet binaries in these locations after exploiting affected hosts for command-and-control enrollment.

Suspicious calc.exe Execution From Non-System Directory via DLL Side-Loading

This rule detects the Windows Calculator binary calc.exe running from a directory other than System32 or SysWOW64. The revived Qbot banking trojan copies a legitimate calc.exe alongside a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. Running a signed system binary from an unexpected path is a common evasion that lets malware execute under a benign process name.

Possible Atlassian Confluence CVE-2023-22515 Setup Recovery Exploitation via Webserver (via webserver)

This rule detects HTTP requests that re-enable the Confluence setup workflow by toggling setupComplete to false and then hitting the setup administrator and finish-setup actions, matching exploitation of the broken access control flaw CVE-2023-22515. It is associated with attacks against internet-facing Atlassian Confluence servers to create rogue administrator accounts. Because these endpoints should never be reachable on a configured instance, this pattern strongly indicates active exploitation.

Malicious Remote Desktop Enablement via Registry

This rule detects the fDenyTSConnections value being set to 0, enabling inbound Remote Desktop connections on a host. During KawaLocker deployment this was combined with firewall disabling to open interactive access for lateral movement. Enabling RDP on servers or endpoints that normally block it expands the attacker foothold.

Suspicious Proxy Execution of rundll32 Control_RunDLL via pcalua.exe (via process_creation)

This rule detects the Program Compatibility Assistant launcher pcalua.exe being used to run rundll32 with shell32.dll Control_RunDLL, a living off the land chain that the RedCurl EarthKapre APT uses to proxy execution of its payload. The pcalua binary masks the parent-child lineage of the launched code. This nested launcher and control panel invocation is not a normal user or administrator workflow.

Malicious Massive Services Deletion Burst (via process_creation)

This rule detects delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Malicious Command Output Written to SMB Named Pipe

This rule detects a command shell echoing data into a local named pipe object which the Dagon Locker actor used as a Cobalt Strike SMB beacon communication channel and this matters because writing to a raw named pipe from a shell is characteristic of beacon linking and post exploitation tasking rather than any legitimate scripting.

Malicious Mamona Ransomware Note and Encrypted File Extension

This rule detects creation of the Mamona ransomware note README.HAes.txt or files bearing the .HAes encrypted extension. These artifacts are written recursively across directories once Mamona completes its offline encryption.

Malicious WordPress REST Batch UNION SQL Injection Attempt

This rule detects requests that carry a UNION based SQL injection in the author_exclude parameter used by the WordPress core CVE-2026-63030 exploitation. The payload chains the author_exclude parameter with UNION and SELECT keywords to extract data through the REST batch endpoint.

Suspicious Computer Account Password Reset via net user by UNC1549

This rule detects the net command resetting the password of a machine account whose name ends with a dollar sign as observed in UNC1549 intrusions. Attackers reset computer account credentials to enable silver ticket abuse or DCSync style credential theft against domain controllers.

Suspicious Qilin EDR Killer BYOVD Service Installation via sc

This rule detects sc.exe creating a service that references the Qilin EDR killer drivers rwdrv or hlpdrv, matching the installation step that registers the bring-your-own-vulnerable-driver components as kernel services. Registering these drivers as services is how the tool loads them to terminate protected processes and suppress ETW. Service creation for these drivers indicates an imminent attempt to blind endpoint defenses.

Suspicious Process Argv0 Masquerade As Kernel Worker via GSOCKET

This rule detects a process launched with an argv0 spoofed to resemble a kernel worker thread such as a bracketed raid5wq name which the GSOCKET tooling uses to hide its reverse connectivity on Linux hosts. Adversaries masquerade as kernel threads to blend into process listings and evade casual inspection.