Sigma detection rules, expert-reviewed

Suspicious Gammadyne Mailer Execution for Direct-to-MX Spam

This rule detects execution of the Gammadyne Mailer utility, matching the direct-to-MX spam blast run from a compromised terminal server in a phishing stager intrusion. Adversaries use this bulk mailer to send high volumes of outbound SMTP directly to recipient mail exchangers, bypassing corporate mail gateways. Its presence on a server is a strong indicator of abuse for mass phishing.

Suspicious Notepad Access to Active Directory Enumeration Output Files

This rule detects notepad.exe opening files named AdUsers.txt or AdComp.txt, matching hands-on-keyboard review of Active Directory enumeration output observed in Akira ransomware intrusions. Operators dump domain user and computer lists to text files and open them in Notepad while scoping the environment before encryption. This reconnaissance review precedes lateral movement and mass data destruction.

Malicious Scheduled Task Running svchost32 Proxy from Windows Temp

This rule detects schtasks creating a task that launches svchost32.exe from the Windows Temp directory, a masquerading socks proxy component observed in the Huntress-analyzed Gentlemen ransomware intrusion. The binary mimics the legitimate svchost name but runs from a non-standard path to establish proxied command-and-control. Creation of this task combines masquerading, persistence, and tunneling into a high-confidence indicator.

Suspicious Firewall Rule Added to Open RDP Port 3389 via netsh

This rule detects netsh adding an advanced firewall rule that opens local port 3389, the Remote Desktop port, observed in a Huntress analysis of exploited RDP misconfigurations. Attackers create this rule to expose RDP through the host firewall after enabling the service. A command-line firewall change opening 3389 during suspicious activity indicates preparation for remote interactive access.

Suspicious RDP Enablement via fDenyTSConnections Registry Modification [Huntress] #2

This rule detects reg.exe setting the fDenyTSConnections value to 0, which enables Remote Desktop connections on a host. It was observed in a Huntress analysis of repeatedly exploited RDP misconfigurations where attackers turned on RDP to establish interactive access. Enabling RDP from the command line during an intrusion facilitates lateral movement and hands-on-keyboard control.

Suspicious MSI Execution Disguised as Network Solutions Agreement

This rule detects msiexec executing a package named Network Solutions Agreement.msi, a social-engineering lure used in a Huntress-tracked malspam campaign to install Tiflux and stealthy RMM tooling. The filename impersonates a business document to trick users into running the installer. Execution of this specific deceptively named MSI indicates the initial malicious install stage.

Suspicious PowerShell Spawned by Komari Monitoring Agent

This rule detects the komari-agent binary spawning PowerShell, the built-in reverse shell behavior of the Komari monitoring tool abused in a Huntress-investigated intrusion. The agent was installed as a NSSM service masquerading as Windows Update Service and used its embedded shell for command execution. A monitoring agent launching an interactive interpreter reflects abuse of its reverse shell capability.

Malicious Remote Command Execution via smbexec Output Redirection Pattern

This rule detects the Impacket smbexec command pattern where cmd.exe runs a quiet echo redirected to an admin share output file, seen in a Huntress-investigated Komari intrusion for remote command execution over SMB. The tool wraps each command with %COMSPEC% /Q /c and writes results to a __output file on the target C$ share. This structural pattern is highly characteristic of smbexec-based lateral movement.

Suspicious Payload Retrieval via finger LOLBin

This rule detects execution of finger.exe, a living-off-the-land binary abused to retrieve remote payloads in a Huntress-observed ClickFix campaign delivering CastleLoader. The lure tricks users into pasting a clipboard command that uses finger.exe to pull attacker content. Because finger.exe is essentially unused on modern Windows, its execution is a strong indicator of malicious download activity.

Suspicious Cloud Instance Metadata Access via Command Line Tool

This rule detects curl or wget requesting the cloud instance metadata endpoint 169.254.169.254, observed in a Huntress Linux intrusion where the actor queried metadata to harvest instance credentials. The link-local metadata service exposes IAM tokens and configuration to any process that can reach it. Command-line access to this endpoint from a shell is a common cloud credential-access technique.

Suspicious File Immutability Set via chattr to Resist Removal

This rule detects chattr setting the immutable attribute with +i, used in a Huntress Linux intrusion to protect attacker-planted persistence and miner files from deletion. Making files immutable prevents responders and integrity checks from removing malicious artifacts. Interactive use of chattr +i outside package management or hardening scripts is unusual and warrants review.

Suspicious Privilege Discovery Spawned by M365 Copilot Process

This rule detects whoami executed with the /priv argument as a child of M365Copilot.exe, an anomalous parentage observed in a Huntress-investigated Nightmare-Eclipse intrusion where the actor masqueraded execution under a trusted application. The Copilot binary has no legitimate reason to spawn privilege enumeration. This parent-child relationship indicates process masquerading paired with hands-on-keyboard discovery.

Malicious Defender Tampering via UnDefend Aggressive Flag

This rule detects execution of the UnDefend tool undef.exe with its -agressive flag, an EDR-tampering utility seen in a Huntress-investigated Nightmare-Eclipse intrusion that targeted the mpavbase.vdm Defender signature file. The distinctive misspelled flag identifies the specific tool used to disable endpoint protection. Disabling security controls precedes credential theft and lateral movement.

Suspicious Local Administrator Account Addition via net localgroup

This rule detects use of net or net1 to add an account to the local Administrators group, observed during a Huntress-tracked Bomgar exploitation campaign where attackers escalated privileges before ransomware deployment. Adding accounts to privileged groups from a command line is a common persistence and privilege-escalation technique. While administrators occasionally perform this manually, it should be corroborated with the initiating process context.

Malicious Command Shell Spawned by Bomgar Remote Support Client

This rule detects the Bomgar remote support client bomgar-scc.exe spawning a command interpreter such as cmd.exe or powershell.exe. It was observed in a Huntress-tracked uptick in Bomgar exploitation where the client spawned a SYSTEM shell used to add administrators and deploy ransomware. A remote support agent launching an interactive shell is a hallmark of post-exploitation abuse of the RMM tool.