Sigma detection rules, expert-reviewed

Suspicious Search-ms URI Handler Abuse to Remote Share

This rule detects command lines invoking the search-ms protocol handler with a remote location parameter, a technique that presents attacker-hosted SMB shares as local search results to trick users into launching malware disguised as documents. This was observed in a fake AnyDesk lure where an LNK masqueraded as a PDF. Search-ms abuse pointing to a remote share is a hallmark of social-engineered initial access.

Suspicious Collection Staging via Archive Utility Filters

This rule detects WinRAR or 7-Zip archiving with a password and document file-type filters, a collection and staging pattern that gathers sensitive files for exfiltration. This was catalogued among data-exfiltration TTP binaries. Password-protected archives scoped to office document types typically indicate deliberate data staging before theft.

Malicious Data Exfiltration via S5cmd to S3

This rule detects the s5cmd client copying local data to an S3 bucket, a high-throughput exfiltration path to attacker-controlled cloud storage. This was catalogued among data-exfiltration LOLBIN binaries. Bulk copying of internal files to S3 indicates staging for double-extortion.

Malicious Data Exfiltration via Backblaze B2 CLI

This rule detects the b2 command line client syncing local data to a b2 cloud bucket, an exfiltration path to attacker-controlled object storage. This was catalogued among data-exfiltration LOLBIN binaries used before extortion. Uploading internal files to Backblaze from servers or endpoints signals data theft.

Malicious Data Exfiltration via Restic Remote Backup

This rule detects restic backing up local data to a rest remote repository, an exfiltration technique that abuses a legitimate backup tool to move victim files to attacker-controlled storage. This was catalogued among data-exfiltration LOLBIN binaries. Backing up internal data to an external repository indicates active theft ahead of extortion.

Malicious Lateral Movement via PsExec File-List Target

This rule detects PsExec executing a batch payload against a list of hosts supplied via an @file argument with the -d, -c, and -h flags, a mass remote-execution pattern used to deploy ransomware fleet-wide. This was observed during KawaLocker ransomware deployment. Copying and running a batch across many hosts at once accelerates encryption throughout the network.

Suspicious Event Log Clearing via Renamed Log Utility

This rule detects an execution using dellog and ClearLog arguments to wipe PowerShell and other event logs, an anti-forensics action to erase attacker activity. This was observed during SonicWall VPN exploitation intrusions. Clearing event logs destroys the evidence responders rely on to reconstruct the intrusion.

Malicious NTDS Credential Theft via Wbadmin Backup

This rule detects wbadmin being used to back up or recover the Active Directory database NTDS.dit, an approach attackers use to extract domain credential hashes offline. This was observed after SonicWall VPN exploitation during Akira intrusions. Access to NTDS.dit yields all domain password hashes and enables full domain compromise.

Malicious ELAM Driver Disable via Bcdedit

This rule detects bcdedit disabling Early Launch Anti-Malware drivers which prevents boot-time protection from loading and allows unsigned or malicious drivers to initialize. This tampering appears in ransomware playbooks that clear the way for kernel-level evasion. Disabling ELAM undermines the boot integrity chain that would otherwise block untrusted drivers.

Suspicious Svchost Execution from Non-Services Parent

This rule detects svchost.exe launched by a parent other than services.exe which indicates process masquerading or code injection rather than a legitimate service host. During Crux ransomware activity a loader spawned svchost.exe with anomalous arguments to blend malicious execution into a trusted process name. Genuine svchost instances are always started by the Service Control Manager.

Malicious Data Exfiltration to MEGA via Rclone

This rule detects rclone copying local data to a MEGA cloud remote, a double-extortion staging and exfiltration step. This behavior was observed during Crux ransomware intrusions prior to encryption. Cloud syncing of internal files to attacker-controlled storage indicates active data theft.

Malicious Boot Recovery Tampering via Bcdedit

This rule detects bcdedit setting bootstatuspolicy to ignoreallfailures which suppresses Windows recovery prompts after crashes, an inhibit-recovery action used by ransomware to keep encrypted systems booting normally. This was observed during Crux ransomware deployment. The change prevents automatic recovery and helps the encryptor complete uninterrupted.

Suspicious Network Reconnaissance via Advanced Port Scanner

This rule detects execution of Advanced Port Scanner, a dual-use network discovery tool frequently abused by ransomware operators to map internal hosts and services before lateral movement. It was observed in RMM-driven intrusions culminating in Akira ransomware. Presence of this tool on servers or endpoints often indicates hands-on-keyboard reconnaissance.

Malicious Cloudflared Tunnel Execution via Cloudflared

This rule detects execution of the cloudflared client to run a named tunnel with an embedded token, providing attackers covert command and control and remote access through Cloudflare infrastructure. This technique was observed in bulk RMM-driven intrusions against MSP customers where actors established persistent tunnels prior to Akira ransomware deployment. Detecting it early exposes attacker C2 egress that bypasses perimeter controls.

Suspicious Outbound Request to Webhook.site Interaction Service

This rule detects curl.exe issuing a request to webhook.site, an out-of-band interaction service Huntress observed being used to confirm code execution and beacon after Wing FTP CVE-2025-47812 exploitation. Attackers rely on webhook.site to receive callbacks and stage small amounts of exfiltrated data over a trusted domain. Outbound requests to this service from a server process are a suspicious command-and-control indicator.