Sigma detection rules, expert-reviewed

Suspicious dMSA Membership Modification via msDS-GroupMSAMembership Attribute

This rule detects Active Directory changes to the msDS-GroupMSAMembership attribute on a delegated managed service account, the self-referential membership manipulation at the core of the Huntress dMSA Ouroboros credential-extraction technique. Writing the dMSA object's own SID into this attribute lets it authenticate to itself and unlock credential extraction. Unexpected modification of this attribute is a high-confidence sign of the abuse chain.

Suspicious Modification of msDS-KeyCredentialLink for Shadow Credential Abuse

This rule detects Active Directory directory-service changes writing to the msDS-KeyCredentialLink attribute, the shadow-credential primitive used in the Huntress dMSA Ouroboros technique to obtain PKINIT authentication material on Windows Server 2025. Populating this attribute lets an attacker request Kerberos tickets and extract credentials for the target object. Modification outside device registration or trusted CA workflows is a strong indicator of credential-access abuse.

Suspicious SOAPHound Null Filter LDAP Query via security

This rule detects Directory Service event 1644 recording an LDAP search that combines the SOAPHound style negated false filter with a security-descriptor SDflags value of 0x7. This filter construction is used to return every object with its security descriptor in a single sweep, so its presence indicates automated bulk Active Directory collection over ADWS.

Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security

This rule detects Directory Service field engineering event 1644 recording LDAP searches that request all attributes with the SDflags control set to 0x7. SOAPHound and similar ADWS-based collectors issue these broad security-descriptor-inclusive queries to map the domain, so this search-filter signature indicates bulk directory harvesting.

Suspicious Active Directory Web Services Query from Localhost via SOAPHound

This rule detects Directory Service event 1644 activity attributed to a client connecting from the IPv6 loopback address over the Active Directory Web Services path, the local ADWS proxying behavior SOAPHound uses to relay LDAP through port 9389. Running the collector on a domain controller and querying ADWS via localhost obscures the true source of enumeration. A loopback ADWS client issuing bulk directory queries is anomalous and suggests on-host reconnaissance tooling.

Suspicious SharpHound Group Enumeration LDAP Filter

This rule detects the characteristic SharpHound LDAP filter clause querying sAMAccountType 268435456 which enumerates security groups during BloodHound collection, captured in Directory Service event 1644. This account-type value selects global and universal groups and appears in the compound filters SharpHound issues while mapping group membership. Its presence indicates automated Active Directory reconnaissance ahead of privilege-escalation path finding.

Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control

This rule detects Directory Service event 1644 queries that combine the LDAP_SERVER_SD_FLAGS_OID control 1.2.840.113556.1.4.801 with retrieval of the nTSecurityDescriptor attribute, the mass access-control enumeration performed by BloodHound style tooling. Reading security descriptors across many objects maps attack paths and delegation abuse opportunities in Active Directory. Broad SD_FLAGS-driven descriptor collection is characteristic of reconnaissance rather than routine administration.

Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion

This rule detects Directory Service event 1644 LDAP search filters that test the userAccountControl DONT_REQ_PREAUTH bit 524288, tolerating whitespace permutations that attackers insert to evade naive signatures. Enumerating accounts with Kerberos pre-authentication disabled is the reconnaissance step preceding AS-REP roasting. The whitespace-tolerant match captures the same intent even when the filter is padded to break exact-string detections.

Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID

This rule detects Directory Service search event 1644 with an LDAP filter using the bitwise OID to find accounts trusted for delegation, matching Impacket findDelegation enumeration. Adversaries locate delegation-enabled accounts to abuse constrained or unconstrained delegation for privilege escalation. These specific delegation bit queries are uncommon in routine directory operations.

Suspicious Kerberoasting LDAP Search Filter for Service Principal Names

This rule detects Directory Service search event 1644 whose LDAP filter enumerates all accounts with a servicePrincipalName set, matching Impacket GetUserSPNs reconnaissance for Kerberoasting. Adversaries list SPN-bearing service accounts to request tickets whose hashes can be cracked offline. Broad servicePrincipalName wildcard queries warrant review when not tied to known administrative tooling.

Suspicious RdpBus Registry Symbolic Link Creation for Privilege Escalation

This rule detects creation or modification of an RdpBus registry key used as a symbolic link, matching the SYSTEM privilege-escalation technique in the CitrixBleed 2 to DragonForce ransomware intrusion. Adversaries plant a REG_LINK RdpBus entry pointing at an attacker-controlled service key and then start a service to execute code as SYSTEM. This registry manipulation is a privilege-escalation indicator on NetScaler and Citrix hosts.

Suspicious Image File Execution Options Debugger Set to ntsd

This rule detects an Image File Execution Options Debugger value being set to the ntsd debugger, matching the defense-evasion technique in the Defence Impairment intrusion where security tools are neutered by hijacking their launch. Registering ntsd as a debugger for a target executable silently terminates or intercepts that process on launch. IFEO Debugger entries pointing at ntsd are a strong tampering indicator.

Suspicious Run Key Persistence Masquerading as NVIDIA Driver Update

This rule detects creation of a Run key value named Update Drivers NVIDEO, a misspelled NVIDIA-themed persistence entry set by the .NET loader in a Huntress-analyzed malspam chain. The loader appends a random suffix but reuses the distinctive misspelled base name to survive reboots. Registry autorun entries impersonating driver updates are a common loader persistence mechanism.

Suspicious Run Key Persistence Executing system.bat via registry_set

This rule detects a HKCU Run value named MicrosoftUpdate that points to a system.bat script. The compromised axios package established persistence by registering a Windows-update-themed autorun entry executing a batch file, so this value indicates user-level persistence for the supply chain payload.

Suspicious GhostSocks Run Key Persistence to AppData Cache via registry_set

This rule detects a HKCU Run key value pointing to update.exe placed under the Microsoft Windows Cache directory in AppData. This behavior is used by fake OpenClaw installers distributing GhostSocks infostealer to establish user-level persistence while masquerading as a legitimate update binary, allowing the malware to survive reboots and continue proxying C2 traffic.