Sigma detection rules, expert-reviewed

Malicious IcedID AdFind Active Directory Reconnaissance via Command Line

This rule detects execution of the AdFind utility used to enumerate Active Directory objects, trusts and subnets. This behavior is associated with IcedID hands-on-keyboard reconnaissance preceding Quantum ransomware deployment. Operators use AdFind to map the domain before lateral movement, making its presence in interactive sessions a strong hunting signal.

Suspicious Web Browser Spawning Scripting or Command Interpreter (via process_creation)

This rule detects a web browser process spawning PowerShell, cmd or scripting hosts, an abnormal chain seen when FileFix lures deliver malware through the browser. Such execution indicates the browser was used as a delivery vector to launch a RAT or infostealer on the host.

Malicious PowerShell Spawned by File Explorer via FileFix Social Engineering (via process_creation)

This rule detects explorer.exe launching PowerShell, which occurs when a user pastes a disguised command into the File Explorer address bar under the FileFix social engineering technique. Attackers trick victims into executing this command to download and run an Interlock RAT or infostealer payload.

Suspicious Obfuscated Batch Execution via Legacy Command Interpreter (via process_creation)

This rule detects the legacy command.com interpreter spawning cmd.exe to run a batch file from a user-writable directory, a pattern used by CypherIT-packed Lumma loaders. The obfuscated batch stage unpacks and launches the stealer while evading naive command-line inspection.

Suspicious ADFind Active Directory Enumeration (via process_creation)

This rule detects execution of the ADFind utility with query flags used to enumerate Active Directory users, computers and trusts. DragonForce operators use ADFind for domain reconnaissance ahead of lateral movement and ransomware deployment, mapping high-value targets across the environment.

Malicious DragonForce Shadow Copy Deletion via Native Utilities (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell cmdlets used to inhibit recovery before encryption. DragonForce ransomware operators run these native utilities to remove backups so victims cannot restore files, maximizing extortion pressure.

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

This rule detects a single-character named executable being spawned by a SAP or web server process. During exploitation of CVE-2025-31324 the web shell writes and runs tools under terse single-character names to evade casual inspection, so this naming pattern under a server parent indicates malicious post-exploitation execution.

Suspicious MeshAgent Installation Arguments (via process_creation)

This rule detects installation of the MeshCentral agent identified by its meshServiceName or installedByUser command-line arguments. Adversaries install MeshAgent to establish covert remote control of a host, so these installation parameters outside a sanctioned deployment indicate RMM misuse.

Suspicious System Discovery via WMIC Query Commands (via process_creation)

This rule detects wmic being used with path or list query parameters to enumerate system, operating-system and network configuration details. Adversaries abuse WMIC to profile a compromised host prior to lateral movement, so path and list query usage indicates hands-on discovery activity.

Suspicious File Copy to Administrative SMB Share via net.exe (via process_creation)

This rule detects enumeration or use of administrative SMB shares such as C dollar through net.exe as part of lateral movement. VanHelsing maps administrative shares to copy its payload across hosts, so referencing an admin share via net commands is a lateral-movement indicator.

Suspicious Shadow Copy Deletion via WMIC or PowerShell (via process_creation)

This rule detects deletion of Volume Shadow Copies via wmic or PowerShell referencing the shadowcopy class with a delete operation. VanHelsing removes shadow copies before encryption to inhibit recovery, so this command pattern flags pre-ransomware impact activity.

Malicious Credential Theft via Mimikatz Command Line (via process_creation)

This rule detects Mimikatz-style credential dumping through its characteristic command modules regardless of the binary name. Medusa operators run Mimikatz to extract plaintext credentials and hashes from memory, so the presence of its module syntax on a command line is a high-confidence credential access indicator.

Possible AnyDesk Execution from Non-Standard Directory (via process_creation)

This rule detects AnyDesk executing from any location other than its legitimate Program Files installation directories. Adversaries run portable AnyDesk from user-writable folders such as Public Music to gain covert remote access, so execution outside the standard install path is a sign of RMM abuse.

Malicious Boot Recovery Tampering via bcdedit (via process_creation)

This rule detects bcdedit modifying boot configuration to disable recovery or force safe boot. LockBit uses bcdedit to turn off automatic repair and boot into a controlled state that eases encryption and inhibits recovery, so these boot changes indicate destructive impact activity.

Suspicious rundll32 Execution Without Command Line Arguments (via process_creation)

This rule detects rundll32 being launched without any DLL or export arguments on its command line. Black Basta loaders spawn rundll32 with no arguments as a host process for injected code, so an argument-less rundll32 invocation is an anomaly worth investigating for defense evasion.