Sigma detection rules, expert-reviewed

Malicious NTDS Extraction via Ntdsutil IFM

This rule detects ntdsutil creating an Install-From-Media snapshot, an technique the profiled APT actors use to dump the NTDS.dit domain database from a domain controller. The IFM path copies every domain credential hash in a single operation. Ntdsutil IFM runs are rare and high-value outside of documented backup jobs.

Malicious LSASS Memory Dump via Comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export against a process, the living-off-the-land technique used by the profiled APT actors to dump LSASS memory. Extracting the LSASS process image yields credentials for lateral movement without dropping a dedicated dumping tool. This command pattern has virtually no legitimate use.

Suspicious Rundll32 Execution Without Arguments

This rule detects rundll32.exe launched with no DLL or export arguments, a hollowing or injection precursor observed in the Gootloader chain. A bare rundll32 process is typically spawned to host injected code rather than to run a legitimate library export. This anomaly is a reliable indicator of process injection staging.

Suspicious PowerShell Download Cradle Writing Executable To Windows Temp

This rule detects a PowerShell process bypassing execution policy and using Invoke-WebRequest to save an executable into the Windows Temp directory. Initial access brokers use this cradle to stage tooling on freshly compromised hosts before handing off access. Writing a remote binary into a world-writable temp path and running it is a common first-stage foothold.

Malicious Volume Shadow Copy Deletion Before Ransomware Encryption

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell, an inhibit-recovery step the Qilin ransomware group performs before encrypting files. Removing shadow copies prevents victims from restoring data without paying. This activity almost always precedes or accompanies encryption.

Suspicious Backgrounded Bash Payload via nohup On macOS

This rule detects a bash payload launched detached from the terminal with nohup and backgrounded, matching the persistence behavior observed in the ClickFix infostealer chain on macOS. The Odyssey and ACR stealers use this pattern so their downloaded script keeps running after the fake verification window is closed. Detaching execution helps the operator survive the user closing the shell they were tricked into using.

Malicious Potato Privilege Escalation Tooling Execution

This rule detects execution of JuicyPotatoNG or iislpe, local privilege escalation tools observed in the ToolShell intrusion to abuse impersonation privileges and elevate from the IIS service account to SYSTEM. These tool names are meaningful campaign constants with no legitimate use. Their presence indicates a post-exploitation privilege escalation attempt.

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe, behavior consistent with the ToolShell SharePoint exploitation chain executing operator commands through a deployed .aspx web shell. A web server worker launching a shell indicates server-side code execution following exploitation. This is a strong indicator of an active web shell on a SharePoint or IIS host.

Suspicious mshta Execution of Remote or Inline Payload (via process_creation)

This rule detects mshta.exe executing content from a remote URL or an inline script protocol, a proxied execution step in Storm-0978 CVE-2023-36884 exploitation. Attackers use mshta to run downloaded OLE-delivered payloads while blending with the trusted HTML application host.

Suspicious Antivirus Uninstallation via msiexec (via process_creation)

This rule detects msiexec launched with a quiet uninstall of an installed product, a technique CACTUS ransomware uses to silently remove endpoint antivirus. Uninstalling security agents through the trusted Windows installer disables protection ahead of credential theft and encryption.

Malicious rundll32 Execution of BoomBox NativeCache DLL (via process_creation)

This rule detects rundll32.exe loading a DLL from the AppData Microsoft NativeCache path with the _configNativeCache export, the BoomBox downloader execution chain. BoomBox uses this proxied DLL execution to run in memory under a trusted binary and stage follow-on payloads used by Nobelium.

Suspicious Defender Exclusion Added via Add-MpPreference (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion path via Add-MpPreference. AresLoader excludes a broad path such as the C drive root so its downloaded payload runs without antivirus scanning. Programmatic creation of Defender exclusions is a common impair-defenses step that precedes payload deployment.

Suspicious MSBuild Execution as LOLBin from User-Writable Path (via process_creation)

This rule detects MSBuild.exe compiling or executing a project located in a user-writable directory rather than a development workspace. Macaw ransomware abuses MSBuild as a signed living-off-the-land binary to run inline C2 tasks and evade application controls. MSBuild driven from Temp or AppData outside of a build pipeline is a defense-evasion indicator.

Malicious Volume Shadow Copy Deletion via Vssadmin or WMIC (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic. Ransomware removes shadow copies so that victims cannot roll back encrypted files from local snapshots, maximizing pressure to pay. Programmatic shadow copy deletion is a well-established impact behavior seen immediately before or during encryption.

Malicious Credential Dumping via Mimikatz Sekurlsa Command (via process_creation)

This rule detects Mimikatz module commands on the command line regardless of the executable name, catching renamed copies of the tool. The sekurlsa and lsadump modules extract plaintext credentials, hashes and tickets from LSASS memory and the SAM. These module strings are highly specific to credential theft and rarely appear in legitimate activity.