Sigma detection rules, expert-reviewed

Malicious vmanage-admin Public Key Authentication in SSH Auth Log

This rule detects SSH authentication events accepting a public key for the vmanage-admin account, an indicator of post-exploitation persistence on Cisco SD-WAN appliances following CVE-2026-20127. Adversaries add their own SSH key and authenticate as vmanage-admin to maintain root-equivalent access and pivot between appliances. Unexpected vmanage-admin key logins from unknown sources signal compromise.

Malicious PowerShell Runtime Loaded Outside PowerShell Host

This rule detects the System.Management.Automation.dll PowerShell runtime being loaded by a process other than a legitimate PowerShell host, the unmanaged PowerShell technique used by Cobalt Strike to execute PowerShell in memory without spawning powershell.exe. Running PowerShell inside an arbitrary process evades monitoring that watches the PowerShell binary. A non-host process loading the automation assembly is a strong injection indicator.

Malicious DLL Side-Loading by 3CX Desktop Application (via image_load)

This rule detects the 3CX desktop application loading ffmpeg.dll or d3dcompiler_47.dll from its own directory, the side-loading chain used in the supply chain compromise. The trojanized ffmpeg first stage and d3dcompiler decryptor run under the trusted signed 3CX process to stage second-stage shellcode.

Malicious OpenClaw Stealer Electron Staging Directory Creation

This rule detects files written into the Clearc0Application directory under AppData Roaming, the Electron application staging path used by the OpenClaw infostealer campaign to deploy its App.exe payload. The directory name is a meaningful campaign constant with no legitimate software association. Its creation indicates OpenClaw stealer installation on the host.

Suspicious LNK File Created In Startup Folder For Persistence

This rule detects creation of a shortcut file inside a user or common Startup folder, a persistence technique used by the updated Gootloader to relaunch its paired JavaScript on logon. The loader drops a .LNK next to its .JS so the chain re-executes at each boot. Startup-folder shortcut writes outside of software installation warrant review.

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

This rule detects creation of the human2.aspx web shell in the MOVEit Transfer wwwroot directory, the backdoor planted after CVE-2023-34362 SQL injection exploitation. The web shell lets Cl0p operators harvest stored files and credentials and maintain access to the transfer server.

Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)

This rule detects creation of the CACTUS ransom note cAcTuS.readme.txt or files renamed with the .cts extension appended during encryption. These artifacts confirm active CACTUS ransomware impact on the host and mark the encryption phase of the intrusion.

Suspicious PrivateLoader NSIS Installer Dropped to Disk (via file_event)

This rule detects creation of the NSIS installer named setup_x86_x64_install.exe on disk. PrivateLoader is distributed through this specific NSIS bundle delivered by pay-per-install and cracked-software lures before it stages further payloads. The distinctive installer filename is a recurring PrivateLoader delivery artifact.

Malicious Macaw Ransom Note or Encrypted File Written (via file_event)

This rule detects creation of the Macaw ransom note macaw_recover.txt or files bearing the .macaw encrypted extension. Macaw drops its recovery note into every affected folder and appends .macaw to each encrypted file. Appearance of these named artifacts confirms active encryption and demands immediate containment.

Suspicious Disk Image Written by Browser or Mail Client via HTML Smuggling (via file_event)

This rule detects a browser or mail client writing an ISO or IMG disk image to disk, the hallmark of HTML smuggling delivery. The EnvyScout dropper reconstructs an image such as NV.img in the browser and the user mounts it to run the hidden payload while bypassing Mark-of-the-Web. Disk images arriving through web or email channels are a common container-evasion technique and should be triaged.

Malicious ASPX Web Shell Written to SharePoint LAYOUTS Directory (via file_event)

This rule detects creation of ASPX files within the SharePoint TEMPLATE LAYOUTS directory, where ToolShell exploitation drops an environmentally unique web shell. Writing executable ASPX content into this server-side path establishes a persistent backdoor for continued access after CVE-2025-53770 exploitation.

Suspicious Kernel Driver Written to AppData Temp Linked to RansomHub EDR Killers

This rule detects a .sys kernel driver file being written into a user AppData Temp directory, a staging behavior used by RansomHub-associated EDR-killer tooling such as EDRKillShifter. Legitimate drivers are almost never dropped to per-user temp paths, so a driver in AppData Temp strongly suggests bring-your-own-vulnerable-driver defense evasion.

Suspicious DNS Query To Interactsh OAST Domain

This rule detects DNS lookups to *.oast.fun, an out-of-band application security testing domain used by the actors exploiting CVE-2026-1731 to confirm blind command injection. A callback to an OAST domain from a server indicates the host executed attacker-controlled code during exploitation. Production systems have no legitimate reason to resolve these interaction domains.

Malicious 3CX Second-Stage C2 Icon Retrieval from GitHub IconStorages (via dns_query)

This rule detects the 3CX desktop application resolving raw.githubusercontent.com, which the second stage contacts to fetch ICO files from the IconStorages repository hiding encoded C2 configuration. This beacon follows a dormancy period and precedes browser credential theft in the supply chain intrusion.

Malicious SUNBURST avsvmcloud.com C2 DNS Query

This rule detects DNS queries to the avsvmcloud.com domain used by SUNBURST for command-and-control via DGA-generated subdomains resolved through CNAME records. The command-and-control domain is a meaningful campaign constant. Any resolution attempt indicates a compromised SolarWinds Orion host beaconing to the adversary.