Sigma detection rules, expert-reviewed

Suspicious VMware PCI Device Disabled via Devcon

This rule detects devcon.exe being used to disable the VMware PCI device identified by hardware ID PCI\VEN_15AD&DEV_0740, a manipulation observed in in-the-wild ESXi VM escape activity. Disabling the VMCI or hypervisor-facing device weakens host isolation and supports the escape and defense-evasion chain. Legitimate use of devcon against VMware virtual hardware IDs is rare and warrants investigation.

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning whoami.exe, a webshell-driven reconnaissance behavior observed following exploitation of an internet-facing server. A web application context should never legitimately execute identity enumeration commands, so this parent-child relationship strongly indicates a deployed webshell running attacker commands. It typically marks the earliest hands-on-keyboard stage after initial access.

Suspicious File Hiding via Attrib System and Hidden Attributes

This rule detects attrib.exe applying the system and hidden attributes to an executable, a masquerading technique observed where the actor hid a malicious dllhost.exe from casual inspection. Marking a payload as a hidden system file conceals it from users and default directory listings. This behavior on user or public paths against an executable is a reliable low-noise indicator of hidden artifact staging.

Malicious Certutil URL Cache Download of Remote Payload

This rule detects certutil.exe being used with the urlcache and split flags to download a remote executable, a living-off-the-land technique used in the intrusion analyzed by Huntress to fetch agent.exe. Certutil is a certificate utility and its use to retrieve arbitrary files over HTTP is almost always malicious ingress tool transfer. Attackers rely on it to evade controls that block common download utilities.

Malicious PowerShell Download of conqueror.exe to Public Directory via Gladinet Exploitation

This rule detects PowerShell or curl downloading the second-stage payload conqueror.exe into C:\Users\Public during post-exploitation of the Gladinet CentreStack and Triofox vulnerability. The actors used Invoke-WebRequest and curl to stage the tool in a world-writable location for later execution. Retrieval of a named executable into a public path from a scripting host is a strong indicator of ingress tool transfer following server compromise.

Malicious systemd-daemon Masquerading Binary Execution on Linux

This rule detects execution of a binary named systemd-daemon, a masquerade used by the PeerBlight Linux backdoor to disguise its persistence component installed via a systemd-agent service unit. The name mimics legitimate systemd tooling to evade casual process review. No genuine systemd binary is named systemd-daemon, so this execution indicates backdoor persistence.

Suspicious macOS Credential Validation via dscl authonly

This rule detects the macOS dscl utility invoked with the authonly option to validate a user password, a credential verification technique used by the AMOS stealer to confirm harvested passwords before privilege escalation. Malware uses dscl authonly to test captured credentials without triggering a login prompt. Scripted authonly checks are atypical of normal user activity.

Malicious mshta Spawning PowerShell Loader via ClickFix

This rule detects mshta.exe spawning PowerShell, the loader chain used by a ClickFix campaign that buries XOR-encoded shellcode in images before injecting into explorer.exe. The mshta stage decodes and launches PowerShell to deliver LummaC2 or Rhadamanthys stealers. mshta parenting PowerShell is a strong indicator of scripted malware execution.

Suspicious mshta Downloading Remote Payload via ClickFix

This rule detects mshta.exe invoked with a remote HTTP URL to download an archive payload, the initial execution stage of a ClickFix campaign hiding malware in images. Attackers trick users into pasting an mshta command that pulls a compressed loader from an attacker server. mshta reaching out to remote URLs is a well known living-off-the-land download technique.

Suspicious Remote MSI Installation from Amazon S3 via msiexec

This rule detects msiexec installing a package directly from an Amazon S3 URL, the delivery method observed during Velociraptor misuse where MsiInstaller events showed remote packages fetched from cloud storage. Remote MSI installation lets attackers deploy tooling without staging files locally. Interactive installs from arbitrary S3 URLs are rarely legitimate on production endpoints.

Suspicious Service Principal Name Discovery via setspn Query

This rule detects setspn being used with the query flag to enumerate service principal names, a Kerberoasting preparation step observed during Velociraptor misuse where the actor queried service accounts such as backup SPNs. Enumerating SPNs identifies service accounts whose tickets can be extracted and cracked offline. Command line SPN queries are uncommon outside administrative auditing.

Suspicious Velociraptor DFIR Agent Spawning Encoded PowerShell

This rule detects the Velociraptor DFIR agent spawning PowerShell with an encoded command, matching attacker misuse of Velociraptor running as LocalSystem to execute payloads following WSUS exploitation. Adversaries repurpose the legitimate incident response tool to run covert commands with high privilege. Velociraptor launching encoded PowerShell outside sanctioned hunts is anomalous.

Suspicious Rclone Cloud Exfiltration Execution

This rule detects Rclone being invoked to copy or synchronize data to a remote cloud target, the exfiltration tool used against educational organizations to bulk-transfer stolen files to attacker-controlled storage. Rclone flags such as remote copy and high transfer counts indicate mass data staging over web services. Unsanctioned Rclone usage on endpoints is a strong exfiltration indicator.

Malicious Masquerading Local Account WDAGUtilltyAccount Created via net user

This rule detects creation of a local account named WDAGUtilltyAccount, a deliberate misspelling of the built-in WDAGUtilityAccount, used by attackers against educational organizations to blend a persistence account into normal system accounts. The typosquatted name is designed to evade casual review of account listings. This masquerade is exclusively malicious and signals attacker persistence.

Suspicious AnyDesk Remote Access Tool Executed from ProgramData

This rule detects the AnyDesk remote access tool running from the C:\ProgramData directory, a deployment pattern used by threat actors targeting educational organizations to establish covert remote control as SYSTEM. Placing AnyDesk in ProgramData rather than its standard install path evades user notice. Unmanaged AnyDesk in this location indicates likely unauthorized remote access.