Sigma detection rules, expert-reviewed

Suspicious osascript Password Prompt via AppleScript Display Dialog (via process_creation)

This rule detects osascript invoking an AppleScript display dialog that requests a password, the credential-harvesting behavior Red Canary tied to Atomic Stealer and related macOS malware. Legitimate applications rarely prompt for a password through scripted dialogs, so this combination indicates an attempt to socially engineer the user into revealing local credentials.

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

This rule detects schtasks.exe creating a scheduled task whose command line references the dllCrt32 or sysCrt32 batch scripts that Red Canary observed dllFake using to persist its stealer for automatic execution. The batch-driven task registration is a distinctive persistence step for this family, so these referenced script names in a task creation indicate implant persistence.

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

This rule detects execution of dllCrt32.exe or sysCrt32.exe from the LOCALAPPDATA Microsoft WindowsApps directory, the dropped stealer binaries Red Canary attributed to dllFake trojanized installers that share code with SecondEye. These named executables in the WindowsApps path are not legitimate Store aliases, so their execution indicates a data-stealing implant staged for credential and clipboard theft.

Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)

This rule detects PowerShell command lines combining base64 decoding with stream decompression routines that Red Canary tied to obfuscated loaders staging Cobalt Strike during a hospital ransomware attack. Adversaries chain FromBase64String with stream decompression to unpack in-memory payloads, so these combined tokens reveal obfuscated execution that plain string matching would miss.

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning cmd.exe, the webshell execution behavior Red Canary observed during a hospital ransomware intrusion where the shell ran net.exe reconnaissance before lateral movement and Cobalt Strike deployment. A web server worker launching an interactive command shell is a strong sign of a deployed webshell running operating-system commands, making early detection critical for catching post-exploitation before ransomware.

Malicious Microsoft Defender Real-Time Monitoring Disabled via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling Microsoft Defender real-time monitoring through the Set-MpPreference DisableRealTimeMonitoring parameter, a defense-evasion behavior Red Canary observed in a hospital ransomware intrusion where wmiprvse.exe spawned PowerShell ahead of Cobalt Strike deployment. Adversaries use this to blind endpoint protection before payload execution and lateral movement, making early detection critical for stopping ransomware before encryption.

Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)

This rule detects wscript.exe spawning powershell.exe, the process chain Red Canary observed when Scarlet Goldfinch first-stage JScript from an updateinstaller.zip lure launched an obfuscated PowerShell command to continue the infection toward NetSupport Manager. Script hosts rarely launch PowerShell during normal use, so this parent-child relationship is a reliable indicator of script-driven execution.

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

This rule detects wscript.exe executing a .js payload from a temporary archive-extraction directory under the user AppData Local Temp path, the delivery behavior Red Canary tied to SocGholish, Gootloader, and Scarlet Goldfinch fake-update lures. Victims download an archive such as Update - 35129.zip, extract it, and double-click a script like Update_123.0.6312.111.js which Windows Script Host runs, so this pattern surfaces script-based initial access before the follow-on payload executes.

Suspicious SSH Authorized Keys Modification via Scripting Interpreter on Linux via Process Creation (via process_creation)

This rule detects a scripting interpreter or shell writing to an SSH authorized_keys file, the account-manipulation persistence technique Red Canary demonstrates using perl in its Linux detection guide. Injecting an attacker-controlled public key grants passwordless SSH access that survives reboots, so unexpected modification of authorized_keys is a strong persistence signal.

Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)

This rule detects the contents of /etc/shadow being read and piped to a bash /dev/tcp network socket, the password-hash exfiltration example from Red Canary's Linux detection guide. Combining access to the credential store with a raw network channel is an unambiguous attempt to steal hashes for offline cracking.

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

This rule detects the classic Linux netcat reverse shell built on a FIFO created with mknod, the interactive shell technique Red Canary covers in its detection engineer guide to Linux. Chaining a named pipe with netcat backconnects a shell to an attacker while avoiding the need for a netcat build that supports the exec flag.

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

This rule detects the SQL Server process spawning cmd.exe or powershell.exe, the xp_cmdshell execution that follows SQL injection against FortiClientEMS in the CVE-2023-48788 exploitation Red Canary reported. A database engine launching a command interpreter is a classic sign of xp_cmdshell abuse turning a SQL flaw into operating system code execution.

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Suspicious NetSupport Manager Client Executing From ProgramData via Process Creation (via process_creation)

This rule detects the NetSupport Manager client (client32.exe) running from the ProgramData directory, the remote access tool abused as a RAT in campaigns delivering malware through MSIX installers per Red Canary. Legitimate NetSupport deployments live under Program Files, so execution from ProgramData indicates an attacker-installed remote access foothold.