Sigma detection rules, expert-reviewed

Malicious Docker Client Targeting Remote Exposed 2375 API

This rule detects the docker client invoked with a remote host flag pointing at TCP port 2375 to run or exec against an exposed Docker Engine API. The Dero miner worm abuses this to deploy malicious containers onto unauthenticated hosts and spread its cryptojacking payload. Remote docker run or exec over 2375 is a clear container-takeover behavior.

Malicious Shell Spawned by Windows Script Host (via process_creation)

This rule detects wscript or cscript spawning PowerShell, cmd or another script host, the staging behavior Gootloader and SocGholish use when a first-stage JScript file launches a second stage. A script host launching a shell is an execution technique tracked in the Red Canary Threat Detection Report. Detecting this parent-child pair surfaces script-based malware progressing to its next stage.

Suspicious Windows Defender Exclusion for PowerShell via Add-MpPreference (via process_creation)

This rule detects the AsyncRAT loader disabling Microsoft Defender coverage by adding process and path exclusions through Add-MpPreference. The campaign excludes the entire C drive and the powershell.exe process to protect its staged payloads. Adding a scripting host as a Defender exclusion is rarely legitimate.

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

This rule detects qemu-system emulator processes started with a user-mode network device that connects to a remote socket while running headless. Actors abuse QEMU by launching it with -netdev user socket connect to a remote host and -nographic to build a covert tunnel out of an environment, so this command line indicates network tunneling through a legitimate virtualization binary rather than normal VM use.

Suspicious Svchost Executed From Outside System32

This rule detects the svchost.exe image executing from a directory other than the Windows system folders as seen when the persistent actor ran a masqueraded svchost from ProgramData and this matters because the genuine service host always launches from System32 or SysWOW64 so any other path is a reliable masquerading indicator.

Enabling RDP service via reg.exe command execution

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Suspicious WhatsAppBackup Data Staging Archive Creation

This rule detects creation of a WhatsAppData.zip archive inside a WhatsAppBackup directory on the system drive. Silver Fox drops a Python stealer that collects victim data into this fixed staging path before exfiltration. A backup themed archive assembled at this hardcoded location signals collection ahead of data theft.

Malicious TEARPAGE wtsapi32.dll Side-Load via BdeUISrv by UNC2970 (via image_load)

This rule detects the BitLocker helper BdeUISrv.exe loading wtsapi32.dll from outside the System32 directory, the DLL search-order hijack UNC2970 used to side-load the TEARPAGE loader. A signed system binary loading a system-named DLL from an unexpected path is a strong side-loading indicator.

Masquerading Kimsuky Troll Stealer Scheduled Task Deletion of ChromeUpdateTaskMachineUAC via schtasks (via process_creation)

This rule detects deletion of the scheduled task named ChromeUpdateTaskMachineUAC through schtasks, a cleanup behavior the Troll Stealer dropper used by Kimsuky performs to remove a masquerading update task after execution. Removing a disguised task named after a browser updater is an uncommon defense-evasion action tied to this intrusion, making it a useful post-compromise signal.

Malicious Regsvr32 Scriptlet or Remote COM Object Execution (via process_creation)

This rule detects regsvr32.exe registering a scriptlet through scrobj.dll or loading a COM object from a remote URL, the "Squiblydoo" proxy-execution pattern. Regsvr32 is a recurring System Binary Proxy Execution technique in the Red Canary Threat Detection Report, abused to run attacker script code under a signed Microsoft binary while bypassing application allowlisting. Detecting the scrobj and remote-URL invocations flags the evasion.

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

This rule detects cmd.exe spawned by the WMI provider host with a command line referencing the ADMIN administrative share, a remote execution pattern Volt Typhoon uses to run commands and stage output over WMI. Combining a WMI parent with administrative share access reflects remote lateral movement rather than routine local scripting, making it a strong signal of interactive intrusion activity.

Malicious AMOS Stealer AppleScript Execution via osascript

This rule detects osascript executing AppleScript that shells out to remove quarantine attributes and grant execution permissions, a technique used by the Atomic (AMOS) Stealer delivered through fake DeepSeek installer sites. Attackers combine do shell script with xattr and chmod to run unsigned payloads while evading Gatekeeper, so this activity is a strong indicator of macOS stealer staging.

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

This rule detects creation of a tsar cron job under etc cron.d as observed in the BrokenSesame research for host persistence. Dropping a system cron file lets an attacker run code as root on a schedule after escaping a container. The specific filename in the system cron directory is a strong persistence indicator.

OpenSSH Server Firewall Configuration on Windows - Command (via process_creation)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

VSS Backup Deletion - WMI (via process_creation)

This rule detects delete existing VSS backup.