Sigma detection rules, expert-reviewed

Malicious Keychain Credential Extraction via security Utility

This rule detects the macOS security utility being used to dump keychain contents or extract stored passwords, a credential theft step performed by MacStealer after harvesting the login password. Reading generic and internet passwords from the keychain lets the malware collect browser and application secrets for exfiltration.

Malicious C2 Configuration Stored in TitanPlus Registry Key (via registry_set)

This rule detects writes to a TitanPlus registry key, the location where the intrusion described by Truesec stored encoded command-and-control server addresses using character substitution. Adversaries hide C2 configuration in an obscure registry value to survive reboots and evade file-based detection, making writes to this named key a targeted persistence and C2 indicator.

Suspicious PHP Webshell File Creation Linked to BeyondTrust Exploitation (via file_event)

This rule detects creation of PHP webshell files named aws.php and file_save.php observed after exploitation of BeyondTrust CVE-2026-1731. These webshells provide persistent remote command execution on the compromised host, so their appearance on a web-accessible path indicates an established foothold.

Suspicious Clearing of System Logs on Linux (via process_creation)

This rule detects commands that delete or truncate files under /var/log, an indicator-removal technique used to erase evidence of intrusion on Linux hosts. Clearing system logs is tracked in the Red Canary Threat Detection Report. Detecting this activity surfaces anti-forensic log destruction.

Malicious PlugX Scheduled Task Named InternetUpdateTask (via process_creation)

This rule detects creation of a scheduled task named InternetUpdateTask, the persistence artifact left by the PlugX malware family to relaunch its DLL sideloaded loader at logon. The benign sounding task name masks recurring execution of the implant, so its creation is a strong indicator of PlugX persistence being established.

Suspicious Kubernetes API Request From Anonymous User

This rule detects Kubernetes API server requests authenticated as the anonymous or unauthenticated system identity which indicates an unauthenticated actor probing the cluster control plane as described in NCC Group Kubernetes detection engineering research. Adversaries leverage anonymous access to enumerate resources and stage container escapes so any such request warrants investigation.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Malicious Reverse SSH Tunnel via Renamed PuTTY svchosts.exe (via process_creation)

This rule detects the Hive0129 BlotchyQuasar RAT establishing a reverse SSH tunnel using a renamed PuTTY binary called svchosts.exe to forward internal SMB and RDP ports over the HTTPS port. The misspelled svchosts.exe name combined with remote-forward switches and batch mode reveals covert tunneling. Legitimate services do not run this binary.

Self-Deletion via Ping Loopback Delay and Del Command

This rule detects a command line that pings the loopback address to introduce a delay before deleting a file, the self-cleanup routine used by PlayBoy Locker to remove its own binary. Chaining ping 127.0.0.1 with del is a common anti-forensic indicator-removal technique in malware.

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

This rule detects netsh.exe enumerating stored wireless profiles with wlan show profile, a command HookSpoofer stealer runs via cmd.exe to harvest Wi-Fi credentials and map nearby networks. The stolen wireless keys support credential theft and local discovery. Detecting this command line flags stealer reconnaissance on infected hosts.

Suspicious Stealth Soldier C2 Request URI (via proxy)

This rule detects HTTP POST requests to the Server Request endpoint used by the Stealth Soldier backdoor for command-and-control. The fixed URI path combined with the POST method is a structured C2 pattern that helps surface backdoor beaconing in web proxy telemetry.

Malicious Linux Cryptominer Masquerading as systemd-logind via var tmp Execution

This rule detects a process executing from /var/tmp/systemd-logind, a Linux cryptominer masquerading as the legitimate systemd-logind daemon which normally runs from /usr/lib/systemd. It was observed in a Huntress-investigated intrusion where a Monero miner beaconed to a mining pool over port 443. Execution of a trusted daemon name from a world-writable temporary directory indicates resource-hijacking malware attempting to evade casual process review.

Suspicious Shell Spawned by PostgreSQL Server via COPY FROM PROGRAM on Linux

This rule detects a PostgreSQL server process spawning a command shell which indicates abuse of the COPY FROM PROGRAM feature for arbitrary command execution as used by the DreamBus botnet after brute-forcing weak database credentials. A database engine launching a shell is not normal behavior and points to post-authentication remote code execution.

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Suspicious LaunchAgent or LaunchDaemon Load via launchctl

This rule detects launchctl loading a property list from a LaunchAgents or LaunchDaemons directory, the persistence mechanism most macOS malware uses to survive reboots. Registering a malicious plist ensures the payload is relaunched automatically by launchd under user or system context.