Sigma detection rules, expert-reviewed

Suspicious Credential Enumeration via cmdkey List

This rule detects execution of cmdkey with the /list argument, used to enumerate stored Windows credentials and RDP secrets. It was seen during post-VPN hands-on-keyboard activity in a Huntress-investigated intrusion where the actor enumerated saved credentials before lateral movement. Interactive credential store enumeration shortly after remote access is a strong indicator of an operator surveying the compromised host.

Suspicious Bash Loopback Reconnaissance via curl Header Request

This rule detects bash spawning curl with a header-only request against the loopback address 127.0.0.1, a reconnaissance behavior observed in a Huntress Linux intrusion tied to cryptomining deployment. Attackers probe locally bound services to fingerprint the host and running listeners before staging further tooling. Loopback curl header probes from a shell are unusual for legitimate administration and warrant review.

Suspicious Chrome Update Suppression via simulate-outdated-no-au Flag via process_creation

This rule detects Chrome launched with the simulate-outdated-no-au switch that suppresses browser auto-updates. The Dragon Boss Solutions PUP abused this flag to keep the browser in a vulnerable, non-updating state, so its presence on a command line indicates deliberate tampering with browser security posture.

Suspicious Data Staging via Everything and 7-Zip Prior to Exfiltration via process_creation

This rule detects the 7-Zip command line tool creating archives with recursive and password-protected options used to compress collected data for exfiltration. NightSpire operators used Everything to locate files and 7-Zip to stage them before uploading via MEGASync, so this archiving pattern indicates collection ahead of exfiltration and encryption.

Malicious Volume Shadow Copy Deletion via PowerShell Child Process via process_creation

This rule detects PowerShell spawning vssadmin, wmic, or WMI calls that delete volume shadow copies. NightSpire ransomware used a PowerShell child process to remove shadow copies and inhibit recovery before encryption, so this behavior is a high-confidence precursor to ransomware impact.

Suspicious osascript Spawning curl to High Port C2 via process_creation

This rule detects the macOS osascript interpreter spawning curl to reach an external host on port 8000. The axios supply chain payload used AppleScript to invoke curl against attacker infrastructure on this non-standard port, so this parent-child pattern indicates macOS command and control retrieval by the malicious package.

Suspicious Node Package Install Spawning Script Interpreters via process_creation

This rule detects node.exe spawning cscript, wscript, or powershell child processes. The compromised axios npm package ran a setup.js install script that chained into Windows script hosts and PowerShell to fetch and execute the next stage, so a Node process launching these interpreters indicates a malicious package post-install execution chain.

Suspicious Credential Archive Staging in tmp via process_creation

This rule detects archive or compression tooling on macOS creating output under the /tmp directory. The infostealer staged stolen browser and credential data into a hidden /tmp subfolder before compressing and exfiltrating it, so archive creation targeting /tmp is an indicator of local collection ahead of data theft.

Suspicious curl POST Exfiltration of Archive from tmp Staging Folder via process_creation

This rule detects curl invoked with an HTTP POST that uploads a file staged under the /tmp directory. A macOS infostealer collected stolen data into a /tmp staging folder and used curl to POST the resulting archive to its C2, so a curl POST referencing a /tmp file indicates active exfiltration of harvested data.

Suspicious Executable Execution from PerfLogs Directory via process_creation

This rule detects executables running from the C:\PerfLogs directory. INC ransomware operators staged and launched their win.exe encryptor from PerfLogs, a location that normally holds only performance trace data and no executables, so any process starting from this path is a strong indicator of malware staging.

Suspicious Scheduled Task Recovery Diagnostics Running PowerShell Script via process_creation

This rule detects schtasks.exe creating a scheduled task named Recovery Diagnostics that executes a new.ps1 script under the SYSTEM context. The threat actor used this task to run their PowerShell tooling with elevated privileges under a benign maintenance name, establishing persistence ahead of data exfiltration and ransomware deployment.

Suspicious Screensaver File Executed as Installer via process_creation

This rule detects a .scr screensaver file being executed directly as a program. In the rogue RMM campaign, invite and SSA themed lures were delivered as SCR installers to trick users into running the initial dropper, so execution of an .scr file outside of screensaver preview contexts indicates a masqueraded installer launching malicious payloads.

Suspicious RMM Uninstall Hiding via HideUL Execution via process_creation

This rule detects execution of HideUL.exe, a utility used to remove or hide entries from the Windows uninstall list. Rogue RMM operators run this tool to conceal their remote management software from Programs and Features so victims and defenders cannot easily find or remove the persistence, indicating deliberate defense evasion around an installed RMM tool.

Suspicious DLL Sideloading via FMAPP Executable from Non-Standard Path via process_creation

This rule detects the legitimate Realtek FMAPP.exe binary executing from a user-writable or non-standard directory rather than its normal program installation path. MuddyWater abused this signed binary to sideload a malicious FMAPP.dll, so execution from unusual locations such as AppData, Temp, or Public indicates a search-order hijack used to run attacker code under a trusted process.

Suspicious SSH Reverse Tunnel Execution via process_creation

This rule detects ssh.exe launched with the -N and -R flags used to establish a remote port forward without an interactive session. MuddyWater used this technique to open a reverse tunnel to attacker infrastructure, enabling persistent remote access and pivoting into the victim network while blending with legitimate SSH usage.