Sigma detection rules, expert-reviewed

Malicious Masquerading Local Account WDAGUtilltyAccount Created via net user

This rule detects creation of a local account named WDAGUtilltyAccount, a deliberate misspelling of the built-in WDAGUtilityAccount, used by attackers against educational organizations to blend a persistence account into normal system accounts. The typosquatted name is designed to evade casual review of account listings. This masquerade is exclusively malicious and signals attacker persistence.

Suspicious AnyDesk Remote Access Tool Executed from ProgramData

This rule detects the AnyDesk remote access tool running from the C:\ProgramData directory, a deployment pattern used by threat actors targeting educational organizations to establish covert remote control as SYSTEM. Placing AnyDesk in ProgramData rather than its standard install path evades user notice. Unmanaged AnyDesk in this location indicates likely unauthorized remote access.

Malicious NTDS.dit Credential Extraction via ntdsutil

This rule detects ntdsutil being used to create a copy of the Active Directory NTDS.dit database, a credential dumping technique seen in Gootloader-enabled intrusions. Extracting NTDS.dit exposes every domain account hash for offline cracking and persistence. Interactive ntdsutil snapshots outside sanctioned maintenance are a strong compromise indicator.

Suspicious Windows Script Host Spawning PowerShell via Gootloader

This rule detects wscript.exe spawning PowerShell, the execution chain used by Gootloader after a user runs a malicious script delivered through SEO poisoning. The script host launches PowerShell to unpack and run the next stage in memory. Script host to PowerShell chains are uncommon in normal environments and warrant scrutiny.

Suspicious RMM Installer Executed from AppData Roaming Installer Directory

This rule detects msiexec installing an MSI from a user AppData Roaming Installer directory, matching the rogue ScreenConnect payload masquerading as LogmeinClient.msi in a Qilin ransomware intrusion. Attackers deploy remote monitoring tools from user-writable paths to maintain covert access. Legitimate RMM installs originate from download or system directories, not roaming profiles.

Malicious bcdedit Recovery Tampering Disabling Windows Boot Repair

This rule detects bcdedit disabling automatic recovery and forcing the system to ignore all boot failures, an inhibit-recovery technique used by the Crux ransomware operation. Turning off recovery and boot repair prevents the operating system from self-healing after encryption. This tampering is almost exclusively associated with ransomware impact preparation.

Suspicious Windows Defender Exclusion Added for Entire Windows Directory

This rule detects Add-MpPreference adding a Defender path exclusion for the broad C:\WINDOWS directory, an impairment technique used by the Nezha threat actor tool. Excluding the entire Windows directory blinds antivirus to malware staged in system paths. This overly broad exclusion is rarely legitimate and indicates deliberate defense evasion.

Malicious Web Server Spawning Command Shell and curl Download via Webshell

This rule detects an Apache httpd web server process spawning a command shell or curl download, matching AntSword webshell activity in the Nezha China-nexus intrusion set. The webserver context is abused to execute commands and pull additional tooling onto the host. Legitimate web servers do not launch interactive shells or file downloaders, making this a strong webshell indicator.

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

This rule detects ipconfig network reconnaissance whose output is redirected into a CentreStac_log.txt file under ProgramData, a marker observed after Gladinet CentreStack and Triofox exploitation. The attacker collects host network configuration and stages it to a staging file for later collection. The specific filename and redirect pattern make this a high confidence indicator of hands-on-keyboard activity.

Suspicious PowerShell Spawned by Web Browser

This rule detects PowerShell launched directly by a web browser process, an execution pattern seen when ClickFix lures drive victims to run pasted commands that establish Cloudflare tunnels or download payloads. This was observed across ClickFix variants. Browsers do not normally spawn PowerShell, so this parent-child relationship strongly indicates malicious execution.

Malicious ClickFix Execution via Headless Conhost

This rule detects a command shell or PowerShell spawned by conhost.exe running with the --headless flag, a ClickFix pattern that hides the console window while executing pasted attacker commands. This was observed across ClickFix variants delivering downloaders. A headless conhost parent for a shell is highly anomalous and indicates user-tricked code execution.

Suspicious Svchost Execution from Non-System Path

This rule detects a process named svchost.exe running from outside System32 or SysWOW64, indicating a renamed interpreter or masquerading binary rather than the genuine service host. In this campaign a renamed Python interpreter posing as svchost.exe executed a disguised image payload for PureRAT. Legitimate svchost always runs from the Windows system directories, so any other path is anomalous.

Malicious Azure AD Token Abuse via Roadtx

This rule detects execution of roadtx, a ROADtools utility used to request and manipulate Azure AD and Microsoft Graph tokens by impersonating first-party clients such as Microsoft Teams. Observed in a hands-on-keyboard operation, it enables token theft and cloud identity abuse against Entra ID. Roadtx on an endpoint indicates an actor pivoting to cloud identity compromise.

Malicious Scheduled Task Executing Binary from NETLOGON

This rule detects schtasks creating a task that runs a binary from the domain NETLOGON share, a persistence and distribution technique that stages ransomware on the domain controller for fleet-wide execution. This was observed during Obscura ransomware deployment. Tasks launching payloads from NETLOGON abuse domain replication to spread the encryptor to every host.

Malicious Shadow Copy Deletion via Vssadmin Quiet

This rule detects vssadmin deleting all shadow copies quietly, an inhibit-recovery action executed before encryption to prevent restore. This was observed during Obscura ransomware deployment. Silent removal of shadow copies denies victims local recovery and confirms destructive intent.