Sigma detection rules, expert-reviewed

Malicious Credential Theft via Mimikatz Command Line (via process_creation)

This rule detects Mimikatz-style credential dumping through its characteristic command modules regardless of the binary name. Medusa operators run Mimikatz to extract plaintext credentials and hashes from memory, so the presence of its module syntax on a command line is a high-confidence credential access indicator.

Possible AnyDesk Execution from Non-Standard Directory (via process_creation)

This rule detects AnyDesk executing from any location other than its legitimate Program Files installation directories. Adversaries run portable AnyDesk from user-writable folders such as Public Music to gain covert remote access, so execution outside the standard install path is a sign of RMM abuse.

Malicious Boot Recovery Tampering via bcdedit (via process_creation)

This rule detects bcdedit modifying boot configuration to disable recovery or force safe boot. LockBit uses bcdedit to turn off automatic repair and boot into a controlled state that eases encryption and inhibits recovery, so these boot changes indicate destructive impact activity.

Suspicious rundll32 Execution Without Command Line Arguments (via process_creation)

This rule detects rundll32 being launched without any DLL or export arguments on its command line. Black Basta loaders spawn rundll32 with no arguments as a host process for injected code, so an argument-less rundll32 invocation is an anomaly worth investigating for defense evasion.

Suspicious Remote Desktop Enablement via netsh Firewall Rule (via process_creation)

This rule detects netsh being used to open the firewall for Remote Desktop connections. Black Basta enables inbound RDP to move laterally and maintain interactive access, so a netsh firewall change referencing Remote Desktop is an indicator of lateral movement preparation.

Malicious File Download via Certutil URL Cache (via process_creation)

This rule detects certutil being used with its URL cache and split switches to download a remote file over HTTP. The BadPilot campaign abuses certutil as a living-off-the-land downloader to fetch additional tooling, so this ingress-tool-transfer pattern indicates staging of second-stage payloads.

Suspicious LSASS Memory Dump via Renamed ProcDump (via process_creation)

This rule detects a ProcDump-style full memory dump of the lsass process regardless of the binary name on disk. The BadPilot campaign renames procdump and invokes it with the full-dump and accept-eula switches against lsass to harvest credentials, so this command-line pattern captures the technique even when the tool is renamed.

Malicious SAM and SYSTEM Registry Hive Credential Dump via reg.exe (via process_creation)

This rule detects reg.exe saving the SAM, SYSTEM or SECURITY registry hives to disk. The BadPilot campaign exports these hives to extract local account password hashes offline, so a reg save targeting credential hives is a high-confidence credential access indicator.

Possible SocGholish Update Task Running Batch File at Highest Privileges (via process_creation)

This rule detects creation of a scheduled task via schtasks that runs a batch file at the highest privilege level on a short recurring interval. SocGholish registers an Update task that launches a batch script every ten minutes with elevated rights, so this combination of highest run level and a batch payload signals persistent malicious execution.

Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)

This rule detects schtasks being launched by cmd or PowerShell to create a scheduled task that points at a payload located in a world-writable directory such as Users Public, PerfLogs or ProgramData. This pattern is used by SocGholish to persist a recurring task that executes staged tooling, indicating establishment of scheduled-task persistence.

Suspicious AnyDesk Execution from Temporary or System Directory (via process_creation)

This rule detects the AnyDesk binary executing from a temporary, ProgramData or System32 directory rather than a normal installation path. Adversaries drop portable AnyDesk into staging directories to gain remote access without a full install, so execution from these locations is a strong sign of RMM abuse rather than sanctioned use.

Suspicious MeshAgent Spawning Command Interpreter (via process_creation)

This rule detects the MeshAgent remote management binary spawning a command interpreter or scheduling utility such as PowerShell, cmd or schtasks. Adversaries abusing MeshCentral use the agent to execute follow-on commands and establish persistence, so an interpreter child under MeshAgent indicates hands-on-keyboard misuse of the RMM tool.

Suspicious AnyDesk Unattended Access Password Set via Command Line (via process_creation)

This rule detects AnyDesk being invoked with the set-password command-line switch to configure an unattended access password. Adversaries abusing remote monitoring and management tooling silently set an unattended password so they can reconnect to the host at will, turning legitimate RMM software into a persistent remote access channel.

Malicious PsExec Service Binary Execution from Windows Directory via services.exe (via process_creation)

This rule detects services.exe spawning a randomly named eight-character executable located directly in the Windows or System32 directory. This behaviour is characteristic of PsExec-style remote service execution used by adversaries for lateral movement, where the tooling drops and launches a service binary under a random name to blend in with legitimate service activity.

Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques

This rule detects PowerShell launched with an encoded command argument, an obfuscation technique used in trending Chinese APT operations to hide malicious script content. Attackers pass Base64-encoded commands to evade command-line inspection, so encoded PowerShell invocations are a common defense-evasion behavior that benefits from execution review.