Sigma detection rules, expert-reviewed

Suspicious Windows Defender or Firewall Service Disabled via Registry

This rule detects registry modifications that disable Windows Defender or the Windows Firewall service mpssvc by setting their service Start value, a defense-evasion step observed after SolarWinds Web Help Desk exploitation. Turning off these services via the registry removes endpoint protection and network filtering before the actor deploys tooling. Direct edits to these security service keys outside patching windows are high-value indicators of tampering.

Suspicious Command Execution Recorded in RunMRU Registry

This rule detects the Explorer RunMRU history recording an entry containing a script interpreter or download command, evidence that a user pasted an attacker-supplied command into the Run dialog as part of a ClickFix lure. This was observed across ClickFix variants. RunMRU values invoking powershell, cmd, mshta, or curl indicate socially-engineered execution through the Run box.

Malicious Run Key Persistence Masquerading as Windows Update

This rule detects creation of an HKCU Run key value named Windows Update Service, a masquerading persistence entry used to autostart the PureRAT loader while appearing as a legitimate update task. This was observed in a Vietnamese threat actor chain. A Run value impersonating Windows Update is a deliberate attempt to hide persistence in plain sight.

Malicious Windows Defender Service Disable via Registry

This rule detects the WinDefend service Start value being set to 4 (disabled) in the registry, preventing Microsoft Defender from launching at boot. This defense-evasion step appears in recurring ransomware playbooks that neutralize endpoint protection before encryption. Disabling the AV service removes real-time protection across reboots.

Malicious Restricted Admin Mode Enabled for Pass-the-Hash RDP

This rule detects the DisableRestrictedAdmin registry value being set to 0 to enable Restricted Admin mode, a modification Huntress observed enabling pass-the-hash authentication over RDP. Attackers turn on this mode so a stolen NTLM hash can be used for interactive remote logon without a plaintext password. Enabling Restricted Admin outside of sanctioned hardening is a strong lateral-movement precursor.

Suspicious Hidden Local Account via SpecialAccounts UserList

This rule detects registry writes under the Winlogon SpecialAccounts UserList key, which hides a local account from the Windows logon screen and user management panels. Akira ransomware operators used this technique to conceal accounts created for persistence. Hidden accounts allow attackers to maintain covert access after initial remediation.

Suspicious RDP Enablement via fDenyTSConnections Registry Modification

This rule detects modification of the fDenyTSConnections registry value to zero, which enables inbound Remote Desktop connections. Akira ransomware operators toggled this value to open RDP for lateral movement across victim hosts. Enabling RDP outside of change control frequently precedes hands-on lateral movement and ransomware staging.

Suspicious Run Key Persistence Under Masquerading Service Names

This rule detects registry Run key persistence created under the masquerading value names WdiServiceHost and ChromeUptodate, both used by an APT targeting Vietnamese human rights defenders to blend with legitimate services and Chrome updates. The names imitate trusted software while pointing to sideloaded implants. Run key persistence executes the payload at every user logon.

LanmanServer MaxMpxCt Registry Modification for Lateral Movement Preparation

This rule detects modification of the LanmanServer MaxMpxCt registry value, which raises the maximum outstanding SMB requests to support high-volume lateral spreading. Huntress observed BlackCat affiliates tuning this value before mass deployment across a network. This uncommon server parameter change is a preparation step for scaled lateral movement and ransomware distribution.

Malicious WDigest UseLogonCredential Enablement for Cleartext Credentials

This rule detects the WDigest UseLogonCredential value being set to 1, which forces Windows to keep cleartext credentials in memory for later theft. This registry modification was used in the pharmacy intrusion to enable plaintext credential harvesting and is almost never legitimate on modern systems.

Suspicious WMI Event Consumer Creation for MbRemoval Persistence via ps_script

This rule detects PowerShell content that registers a WMI event subscription tied to Win32_ProcessStartTrace with a consumer named MbRemoval. The Dragon Boss PUP used permanent WMI event consumers to react to process starts and remove security tooling, so creation of this MbRemoval consumer indicates stealthy WMI-based persistence and defense evasion.

Malicious Credential Stealer PowerShell Script Names Targeting Financial Services

This rule detects execution of PowerShell stealer scripts named for financial and cryptocurrency services such as secure.chase.ps1, qb_check.ps1 and coinbase_check.ps1 observed in the reviewed intrusions harvesting banking and wallet credentials. These distinctive script names encode the targeted brand and are stable indicators of the stealer tooling. Their appearance in command lines or script block logs indicates active credential access against financial accounts.

Suspicious Windows Defender Exclusion Added via Add-MpPreference

This rule detects use of Add-MpPreference to add Windows Defender path or extension exclusions, a defense-evasion step observed in the intrusion where the actor carved out exclusions before staging malware. Excluding a directory or file type from scanning lets subsequent payloads run undetected. While admins occasionally set exclusions, unexpected additions on endpoints frequently precede malware deployment.

Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent

This rule detects PowerShell using Get-WinEvent to harvest Terminal Services event ID 1149, which records successful RDP authentications, as seen in the r.ps1 script from a Qilin ransomware attack. Attackers mine these events to identify prior remote access sources and valid accounts for lateral movement. Bulk collection of RDP logon events is uncommon outside of forensic tooling.

Malicious Defender Exclusion Addition via Add-MpPreference

This rule detects Add-MpPreference adding Microsoft Defender path or extension exclusions, carving out blind spots where malware can run and write files unscanned. This was observed during Cephalus ransomware deployment. Attacker-created exclusions let the encryptor and staging artifacts evade real-time protection.