Sigma detection rules, expert-reviewed

Malicious Data Exfiltration via curl with Stealer Specific BuildID Header

This rule detects curl invoked with the custom BuildID or buildid HTTP header used by the Atomic and Odyssey macOS information stealers to exfiltrate collected data to their command and control servers. These distinctive headers identify the stealer build during the collection upload. Detecting them surfaces active credential and data theft on macOS endpoints.

Suspicious ScreenConnect Remote Access Binary Running Under a Renamed Executable

This rule detects a process whose original filename identifies it as ScreenConnect or SimpleHelp remote access software but whose on disk name has been changed which indicates masquerading to evade detection during phishing driven RMM abuse. Renaming remote support tools helps adversaries hide interactive access from defenders. Detecting the mismatch surfaces disguised remote access tooling.

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

This rule detects AteraAgent executed with IntegratorLogin and CompanyId parameters which perform a silent unattended enrollment of the Atera remote monitoring agent. Adversaries in phishing campaigns delivering RMM tools use these switches to covertly onboard victim hosts into an attacker controlled Atera tenant. Detecting this command line surfaces unauthorized remote access tool deployment.

Suspicious Login Shell Assigned to Service Account games on Linux

This rule detects a command that assigns an interactive login shell to the built in games service account which DripDropper abuses to convert an unused system account into a usable backdoor. Service accounts normally have a nologin shell so granting one a real shell is a strong sign of account manipulation. Detecting this change surfaces persistence via a valid but repurposed account.

Suspicious SSH Daemon Configuration Change Enabling Root Login

This rule detects command line modification of the SSH daemon configuration to enable root login which DripDropper performs to strengthen its foothold on compromised cloud Linux hosts. Allowing direct root SSH access gives adversaries durable privileged remote access. Detecting edits that set PermitRootLogin surfaces account manipulation used for persistence.

Suspicious node.exe Execution Spawned by PowerShell

This rule detects the Node.js runtime being launched by PowerShell which is the loader behavior of the Mocha Manakin NodeInitRAT backdoor. Delivering a backdoor through node.exe lets adversaries run a full featured JavaScript implant while masquerading as a legitimate developer tool. Detecting node spawned from PowerShell surfaces execution of the custom backdoor.

Possible Remote Monitoring and Management Tool Abuse for Remote Access

This rule detects execution of remote monitoring and management tools including AnyDesk TeamViewer and NetSupport client32 that adversaries such as Storm-1811 abuse to gain hands on keyboard access after social engineering. These tools are legitimate but are frequently deployed by intruders to maintain interactive control of victim hosts. Detecting their execution supports baselining and hunting for unsanctioned remote access.

Suspicious Executable Download to Temp Directory via curl on Linux

This rule detects curl invoked to write a downloaded file into the /tmp directory which was used in SAP NetWeaver post exploitation to stage second stage executables and a cryptominer. Writing remote payloads to world writable temp locations is a common ingress and staging technique on Linux. Detecting it surfaces tool transfer that often precedes malware execution.

Suspicious Base64 Decoded Payload Piped to Shell on Linux

This rule detects a base64 decode operation piped directly into a shell interpreter which was used after SAP NetWeaver exploitation to deobfuscate and run attacker payloads. Chaining base64 decoding into sh or bash lets adversaries hide command content from simple monitoring. Detecting this pattern surfaces obfuscated command execution on compromised Linux hosts.

Suspicious Batch Script Execution Spawned by wscript via VBScript

This rule detects cmd running a batch file that was launched by wscript executing a VBScript which is the delivery chain used by the Tangerine Turkey cryptomining worm spreading through removable media. The worm uses a VBScript on a USB drive to invoke a batch script that stages XMRig. Detecting this parent-child chain surfaces user execution and worm propagation before the miner deploys.

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

This rule detects sqlite3 querying the gcloud access_tokens.db credential store under the user gcloud config directory, the local token-theft behavior Red Canary documented for harvesting GCP access tokens. These cached tokens are stored in plaintext and remain valid after key deletion, so direct database access outside the gcloud tool indicates credential theft.

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

This rule detects chrome.exe or msedge.exe launched with a remote debugging port together with a profile directory argument, the app-bound encryption bypass Red Canary observed across Stealc, Vidar, Cryptbot, Remcos, and Lumma stealers. Attackers drive a headless debugging session to read decrypted cookies from a live browser profile, so this argument combination indicates credential and session theft.

Suspicious Browser Launch with Unpacked Extension Loaded via load-extension (via process_creation)

This rule detects chrome.exe or msedge.exe launched with the --load-extension argument, the browser-hijacking persistence Red Canary observed for sideloading an unpacked extension without user interaction. Adversaries use this flag to inject a malicious extension for credential and session theft, so its use outside developer workflows warrants review.

Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)

This rule detects the NW.js runtime nw.exe executing from the AppData Roaming directory, the Charcoal Stork behavior Red Canary documented for delivering Yellow Cockatoo and related payloads. Legitimate NW.js applications install under Program Files, so execution from a user roaming profile indicates a bundled malicious NW.js package.

Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)

This rule detects mshta.exe spawning powershell.exe, the FakeSG execution chain Red Canary highlighted where a malicious HTA launches PowerShell to continue the infection. The HTML Application host launching PowerShell is uncommon in legitimate activity, so this parent-child pairing indicates script-based execution through a living-off-the-land binary.