Sigma detection rules, expert-reviewed

Suspicious Osascript Muting System Volume via BANSHEE Infostealer

This rule detects osascript executing an AppleScript command that mutes the system output volume which is an anti-analysis behavior performed by the BANSHEE macOS infostealer to hide audible feedback during execution. Adversaries silence the host so credential and data theft proceed without alerting the user.

Suspicious Credential Store Access for WinSCP and PuTTY via PowerShell (via ps_script)

This rule detects PowerShell script content referencing WinSCP and PuTTY session registry stores or the Windows Credential Manager enumeration API, the credential theft behavior of the SEO poisoning infostealer. These paths and calls harvest saved SSH, SFTP and enterprise credentials. Scripts touching these secrets stores are a strong credential access indicator.

AnyDesk Network

Detects use of AnyDesk

Suspicious Child Process Spawned From Java Following Web Exploitation

This rule detects a Java process spawning a command shell or discovery utility, the post-exploitation behavior seen after ShinyHunters exploited the Oracle PeopleSoft PeopleTools zero-day to gain code execution. A Java application server launching cmd, PowerShell or reconnaissance commands is a strong web-exploitation indicator. This pattern precedes remote-management deployment and lateral movement.

Malicious Katz Stealer Command-and-Control via katz-ontop User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive katz-ontop token appended to the User-Agent string by the Katz Stealer implant during command-and-control communication. Adversaries leverage this hardcoded agent identifier to beacon to their infrastructure, making detection valuable for exposing active stealer command-and-control on the network.

Suspicious Child Process Spawned by 3CXDesktopApp via Supply Chain Compromise

This rule detects the 3CXDesktopApp.exe process spawning a command interpreter such as cmd.exe or powershell.exe. During the 3CX supply chain compromise the trojanized client executed follow-on commands to profile the host and retrieve second-stage payloads after sideloading a malicious ffmpeg.dll. The VoIP client has no legitimate reason to launch shells.

Suspicious Efimer Persistence via Run Controller Value (via registry_set)

This rule detects creation of a controller value under the current user Run key used by the Efimer crypto-stealing Trojan for persistence. Efimer spreads through mass-mailing and installs a clipboard hijacker that swaps cryptocurrency wallet addresses. The named autorun entry re-launches the controller component at every logon.

Suspicious STS AssumeRole With Exfil Session Name via CloudTrail (via cloudtrail)

This rule detects the Shai Hulud actor assuming high privilege roles using session names that begin with exfil such as exfil, exfil10 and exfil12 to run Systems Manager commands and read data. Operator chosen session names that reveal exfiltration intent are a strong hunting signal. These sessions preceded Redshift data theft.

Suspicious Process Execution From Recycle Bin Directory

This rule detects execution of an executable located inside a Recycle Bin directory such as RECYCLER.BIN or $Recycle.Bin. In a case analyzed by Kaspersky a CEFHelper.exe payload was launched from RECYCLER.BIN on a USB drive to enable DLL sideloading. Legitimate software is not executed from the Recycle Bin so this location strongly indicates staging of a hidden payload for defense evasion.

Malicious Veeam Credential Extraction via sqlcmd Query (via process_creation)

This rule detects the use of sqlcmd to query the Credentials table of the VeeamBackup database, a technique used in Akira ransomware intrusions to recover stored backup infrastructure credentials for lateral movement and backup destruction. Direct sqlcmd access to the Veeam credential table is not typical of routine administration.

PureHVNC RAT Execution via AutoIt Interpreter from WordGenius Technologies Directory (via process_creation)

This rule detects the PureHVNC AutoIt interpreter, renamed SwiftWrite.pif or AutoIt3.exe, executing a compiled script from the WordGenius Technologies directory in the user profile. Adversaries run the RAT through AutoIt to abuse a legitimate interpreter and evade static detection, making the combination of the renamed interpreter and the campaign install path a reliable execution signal.

Malicious regsvr32 DLL Execution with Custom Install Argument

This rule detects regsvr32 executed silently with the /n and /i install switches to register and pass a custom argument to a DLL, a technique observed in the AppleSeed triple-combo campaign that ran tripservice.dll with the marker /i:tgvyh. It captures signed-binary proxy execution used to run attacker DLL code while bypassing application controls. Detecting this is important because the combination of /s /n /i on regsvr32 rarely appears in legitimate software.

Suspicious Obfuscated Shell Execution via sh -c bash Redirection (via process_creation)

This rule detects the sh -c argument-to-bash redirection trick used to obfuscate reconnaissance commands after Ivanti EPMM exploitation. This construct hides the real command from naive process logging by passing it through positional parameters. It is a distinctive obfuscation pattern rarely seen in benign automation.

Suspicious Event Log Clearing via wevtutil (via process_creation)

This rule detects use of wevtutil to clear Windows event logs which was observed being run in a loop over multiple log channels during a BitLocker ransomware intrusion. Clearing logs removes forensic evidence of attacker activity. Destroying event history hinders incident response and hides the actions leading up to encryption.

Suspicious Cloudflared Tunnel Execution with Token

This rule detects execution of the cloudflared client to run a named tunnel with an embedded token, establishing an outbound encrypted channel that bypasses perimeter controls. Akira ransomware operators used cloudflared tunnels for covert remote access into victim networks. Unsanctioned tunneling tools provide attackers persistent command and control that evades firewall inspection.