Sigma detection rules, expert-reviewed

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

This rule detects curl or wget fetching the Kinsing exploitation Spring context files poc.xml or linux-poc.xml. During ActiveMQ CVE-2023-46604 exploitation the broker is coerced into loading a remote XML that pulls the next stage, so these filenames in a download command indicate active exploitation.

Malicious Microsoft Defender Services Stopped via sc.exe

This rule detects sc.exe stopping core Microsoft Defender services such as WinDefend, Sense or WdNisSvc. Disabling these services terminates endpoint and EDR telemetry, a defense evasion step used by intruders before continuing their operation as described by Sekoia.

Suspicious Microsoft Defender Definitions Removed via MpCmdRun

This rule detects MpCmdRun.exe being used to remove all Defender signature definitions. Adversaries strip antivirus definitions to degrade detection coverage before executing malware, an evasion behaviour highlighted in Sekoia Defender tampering research.

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

This rule detects the .NET AddInProcess32.exe host process establishing outbound connections to TCP ports 56001 through 56003. Attackers reflectively load the PureRAT payload into AddInProcess32.exe to blend malicious traffic with a signed Microsoft binary. Outbound traffic from this process to the fixed high port range is a strong indicator of PureRAT command and control.

Suspicious ctfmon.exe Network Connection to PikaBot C2 Ports

This rule detects the injected ctfmon.exe process establishing outbound connections to uncommon high ports used by PikaBot command and control such as 2078, 2083, 2222 and the 13720-13786 range. Because ctfmon.exe never initiates network traffic legitimately, any such connection indicates the malware beacon operating from hijacked memory. This helps surface active C2 that evaded process based detection.

Suspicious HTA File Dropped into Startup Folder

This rule detects creation of an HTA file inside the user Startup folder. Gamaredon abuses a WinRAR path traversal flaw to place an HTA into Startup for persistence in the GammaPhish chain. Auto-executed HTML applications in a Startup directory are almost always malicious persistence.

Suspicious Autostart Desktop Entry Persistence via Linux File Creation

This rule detects creation of a system-backup.desktop autostart entry under the user config autostart directory on Linux. TransparentTribe uses this masqueraded desktop file together with a systemd unit and a per-minute crontab to persist the DeskRAT implant. A backup themed autostart entry is a low effort way to regain execution at every login which is why it warrants review.

Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)

This rule detects creation of the hidden dropper script used by the PolarEdge QNAP backdoor in the temp directory. After exploiting CVE-2023-20118 the implant writes a hidden qnax shell script to stage its components. A hidden script with this name in tmp is a specific artifact of the PolarEdge implant.

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

This rule detects creation of files bearing the Interlock ransomware extension or its ransom note marker. The Interlock ransomware appends the interlock extension to encrypted files and drops a note referencing !NT3R10CK. Observing these file artifacts confirms active encryption on the host.

Malicious MuddyRot Payload Drop in ProgramData SoftwareMemory Directory

This rule detects creation of documentsmanagerreporter.exe inside a softwarememory folder under ProgramData, the staging path used by the MuddyWater MuddyRot implant during installation. Writing this specific file marks the initial deployment of the backdoor before persistence and C2 are established. Early detection at the drop stage allows containment before execution.

Suspicious AWS EC2 Serial Console Access Enabled via Scattered Spider Technique

This rule detects the AWS API call EnableSerialConsoleAccess which turns on account wide EC2 serial console access. Scattered Spider style intruders enable this to obtain out of band shell access to instances and bypass network and SSH controls. Because enabling serial console access is rare in normal operations it is a strong signal of hands on keyboard abuse.

Suspicious AWS GuardDuty Detector Tampering

This rule detects tampering with AWS GuardDuty through DeleteDetector, UpdateDetector or CreateIPSet operations. Attackers disable the detector or add trusted IP allowlists so their activity is no longer flagged, undermining threat detection in the account.

Suspicious Rootkit Configuration Registry Keys (via registry_set)

This rule detects registry values written under SOFTWARE keys prefixed with the distinctive nya marker. The OBSCURE#BAT campaign stored rootkit DLLs, driver paths, and AES keys under these keys to configure its stealthy user-mode rootkit.

Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)

This rule detects a registry Run key value that points to a file located in the Public Libraries directory. The MULTI#STORM campaign created OneDrive Update Run keys referencing url files staged there for persistence.

Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)

This rule detects wscript or cscript spawning PowerShell that runs an Invoke-RestMethod download cradle. The Veil#Drop campaign used a JavaScript launcher under the script host to invoke a remote PowerShell loader.