Sigma detection rules, expert-reviewed

Malicious Defender Threat Action Override via Set-MpPreference

This rule detects Set-MpPreference configuring SevereThreatDefaultAction to Allow (6) so Microsoft Defender takes no action on severe detections. This weakens protection while leaving the AV appearing enabled, a subtle evasion used in enduring ransomware playbooks. Setting default threat actions to allow lets malware execute despite detection.

Malicious Volume Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell that enumerates Win32_Shadowcopy objects and pipes them to Remove-WmiObject to destroy volume shadow copies, an inhibit-recovery step preceding encryption. This behavior was observed in RMM-enabled intrusions leading to Akira ransomware. Removing shadow copies denies victims local recovery and signals imminent ransomware detonation.

PowerShell Local Account Creation With Self-Deleting Script

This rule detects a PowerShell script that creates a local user account and then removes itself from disk, a persistence-with-cleanup pattern observed during MSSQL server intrusions. Huntress recovered a user.ps1 that invoked New-LocalUser before deleting its own file. Combining account creation with self-deletion indicates covert backdoor account provisioning rather than routine administration.

Suspicious AstarionRAT HTTP Beacon Cookie Values

This rule detects outbound HTTP requests carrying the distinctive cookie tokens AFUAK, BLA or HFK used by the AstarionRAT command and control beacon observed in the analyzed intrusion. These structured cookie values are protocol-specific constants of the RAT rather than incidental strings, making them reliable network indicators. Traffic bearing these cookies signals an active RAT check-in and should be investigated as a compromise.

Suspicious macOS Keychain Credential Dumping via security find-generic-password

This rule detects use of the built-in security command line utility to extract stored secrets from the macOS Keychain with find-generic-password. The MacSync stealer analyzed by Huntress abused this technique to harvest saved credentials from compromised hosts. Because the security binary is legitimate, focus on unexpected parent processes and scripted invocations that indicate credential theft rather than administrator activity.

Suspicious PowerShell Web Request to oastify Out-of-Band Domain

This rule detects PowerShell issuing a web request to an oastify.com domain, matching out-of-band interaction and tool retrieval observed after SQL injection compromise. The oastify.com domain is used for out-of-band application security testing callbacks and is abused by intruders to confirm code execution and pull payloads. PowerShell contacting this domain indicates active exploitation.

Suspicious Creation of ctxsvc Local Account via net Command

This rule detects creation of a local user or group membership change for the ctxsvc account using net.exe, matching the persistence activity in the CitrixBleed 2 to DragonForce ransomware intrusion. Adversaries create a ctxsvc account masquerading as a Citrix service account and add it to privileged groups to maintain access. Creation of this account name is a persistence indicator on NetScaler-adjacent hosts.

Suspicious s5cmd Execution for Cloud Storage Exfiltration

This rule detects execution of s5cmd, a high-throughput S3 client, matching the data-exfiltration stage of the vibe-coded malware intrusion. Adversaries use s5cmd to rapidly upload staged files to attacker-controlled cloud storage. Presence of s5cmd on endpoints is rare in normal operations and suggests bulk exfiltration.

Suspicious PowerShell Execution of Untitled1 Script From ProgramData

This rule detects PowerShell executing a script named Untitled1.ps1 from the ProgramData directory, matching the vibe-coded Active Directory enumeration tool analyzed by Huntress. The default editor script name dropped into a world-writable path is used to run domain reconnaissance. Execution of this named script from ProgramData indicates hands-on-keyboard enumeration.

Suspicious Scheduled Task Creation With RMMProject Loader Task Names

This rule detects creation of scheduled tasks named msiInstall2 or ekShell2, matching the persistence mechanism of the Potemkin loader and RMMProject intrusion. Operators register these named tasks to relaunch loader and shell components across reboots. These specific task names are strong indicators of this campaign's persistence.

Suspicious mshta Execution Proxied Through pcalua LOLBIN

This rule detects the Program Compatibility Assistant (pcalua.exe) launching mshta.exe, matching the ClickFix execution chain of the Potemkin loader and RMMProject campaign. Adversaries abuse pcalua as a signed proxy to spawn mshta and run remote HTA or script payloads while evading parent-child heuristics. This chain initiates loader delivery and follow-on remote access tooling.

Suspicious Gammadyne Mailer Execution for Direct-to-MX Spam

This rule detects execution of the Gammadyne Mailer utility, matching the direct-to-MX spam blast run from a compromised terminal server in a phishing stager intrusion. Adversaries use this bulk mailer to send high volumes of outbound SMTP directly to recipient mail exchangers, bypassing corporate mail gateways. Its presence on a server is a strong indicator of abuse for mass phishing.

Suspicious Notepad Access to Active Directory Enumeration Output Files

This rule detects notepad.exe opening files named AdUsers.txt or AdComp.txt, matching hands-on-keyboard review of Active Directory enumeration output observed in Akira ransomware intrusions. Operators dump domain user and computer lists to text files and open them in Notepad while scoping the environment before encryption. This reconnaissance review precedes lateral movement and mass data destruction.

Malicious Scheduled Task Running svchost32 Proxy from Windows Temp

This rule detects schtasks creating a task that launches svchost32.exe from the Windows Temp directory, a masquerading socks proxy component observed in the Huntress-analyzed Gentlemen ransomware intrusion. The binary mimics the legitimate svchost name but runs from a non-standard path to establish proxied command-and-control. Creation of this task combines masquerading, persistence, and tunneling into a high-confidence indicator.

Suspicious Firewall Rule Added to Open RDP Port 3389 via netsh

This rule detects netsh adding an advanced firewall rule that opens local port 3389, the Remote Desktop port, observed in a Huntress analysis of exploited RDP misconfigurations. Attackers create this rule to expose RDP through the host firewall after enabling the service. A command-line firewall change opening 3389 during suspicious activity indicates preparation for remote interactive access.