Sigma detection rules, expert-reviewed

Suspicious Hidden PowerShell Download and Archive Expansion

This rule detects hidden-window PowerShell that downloads content with Invoke-WebRequest and expands an archive in the same command. This chain was used to retrieve and unpack the XWorm loader, combining ingress tool transfer with a hidden window to evade user awareness.

Malicious LSASS Credentials Dump via Task Manager - File (via file_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Suspicious Credential File Harvesting of NPM Claude and SSH Secrets

This rule detects a command that reads sensitive credential files including the npm token store the Claude MCP configuration and SSH private keys. Malicious npm packages harvest these files to steal registry tokens API keys and keys for onward access. Detecting bulk reads of these secret paths reveals credential theft staged from a compromised developer machine.

Suspicious Remote Scheduled Task Creation via schtasks for Lateral Movement (via process_creation)

This rule detects schtasks.exe creating a task against a remote system with a run-as account, the remote task scheduling method used during SUNBURST lateral movement to execute payloads on other hosts. Remote schtasks create with a system run level is rare in normal administration. Detecting it exposes lateral tool execution across the environment.

Malicious Regsvr32 Registration of DynamicWrapperX (via process_creation)

This rule detects regsvr32 registering the dynwrapx ActiveX component. DarkWatchMan RAT registers DynamicWrapperX to invoke Windows API calls from its JavaScript payload.

Suspicious Scheduled Task Masquerading As System Process

This rule detects schtasks creating a task named after a core Windows process such as winlogon csrss or dllhost. The PowerRAT and DCRAT campaign registered scheduled tasks impersonating winlogon csrss and dllhost triggered at logon or on a minute interval. Naming a scheduled task after a trusted system process combines persistence with masquerading to evade casual task review.

Suspicious FinCounter DNS Tunneling Query via dns_query

This rule detects DNS queries whose leftmost label begins with the counter prefix used by the FinCounter DNS tunneling toolkit. Unit 42 catalogued this fixed prefix as a distinctive encoding marker of FinCounter command-and-control over DNS, so repeated queries of this shape from a host suggest a covert DNS tunnel.

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

This rule detects the use of wmic to enumerate services by their executable path and delete or stop those belonging to Sophos endpoint protection, a technique used by Terminator and its variants to disable security tooling before deploying ransomware or a cryptominer. The command selects services whose PathName matches a security vendor string and invokes delete or stopservice.

Suspicious Scheduled Task Named mail for Loader Persistence

This rule detects creation of a scheduled task named mail, used in this attack to persist the XWorm loader. Scheduled task creation with a generic disguised name is a common persistence method and warrants review of the referenced task action.

Suspicious SELinux Policy Module Loading to Whitelist Linux Implant (via process_creation)

This rule detects use of audit2allow to build a custom SELinux module and semodule to load it, the defense-evasion behavior APT28 used in Operation Roundish to permit its implant under SELinux. Adversaries leverage generated policy modules to silence SELinux denials that would otherwise block malicious activity.

Malicious New Member Added to a "OCS/Lync/Skype for Business" Administration Group - Medium Risk (via security)

This rule detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.

Malicious DNS Query To ClickFix Infostealer C2 Domain

This rule detects DNS resolution of apposx.com, the fake Cloudflare verification and staging domain used in the ClickFix infostealer campaign. The domain fronts the social-engineering lure that leads macOS users to install the Odyssey and ACR stealers. Alerting on the hardcoded C2 domain surfaces hosts that reached the delivery infrastructure regardless of the payload used.

Suspicious Duke Malware DLLs Written to Windows Tasks Directory (via file_event)

This rule detects the Duke malware support DLLs being written into the Windows Tasks directory during the APT29 German Embassy campaign side-loading chain. Dropping Mso.dll and AppVIsvSubsystems64.dll into C:\Windows\Tasks stages the side-loading pair for msoev execution. DLL creation in this task directory is abnormal and indicates payload staging.

Suspicious Shell Execution Referencing Mounted DMG Volume via Terminal (macOS)

This rule detects a shell process launched by Terminal whose command line references a path under /Volumes, matching the drag-to-Terminal execution technique used by fake macOS installers to run infostealer payloads. Adversaries populate the Terminal prompt with a path to a mounted DMG so the victim executes the payload manually. This bypasses Gatekeeper prompts and leads to credential and browser data theft.

SplashTop Process

Detects use of SplashTop