Sigma detection rules, expert-reviewed

Suspicious Network Reconnaissance via Advanced Port Scanner

This rule detects execution of Advanced Port Scanner, a dual-use network discovery tool frequently abused by ransomware operators to map internal hosts and services before lateral movement. It was observed in RMM-driven intrusions culminating in Akira ransomware. Presence of this tool on servers or endpoints often indicates hands-on-keyboard reconnaissance.

Malicious Cloudflared Tunnel Execution via Cloudflared

This rule detects execution of the cloudflared client to run a named tunnel with an embedded token, providing attackers covert command and control and remote access through Cloudflare infrastructure. This technique was observed in bulk RMM-driven intrusions against MSP customers where actors established persistent tunnels prior to Akira ransomware deployment. Detecting it early exposes attacker C2 egress that bypasses perimeter controls.

Suspicious Outbound Request to Webhook.site Interaction Service

This rule detects curl.exe issuing a request to webhook.site, an out-of-band interaction service Huntress observed being used to confirm code execution and beacon after Wing FTP CVE-2025-47812 exploitation. Attackers rely on webhook.site to receive callbacks and stage small amounts of exfiltrated data over a trusted domain. Outbound requests to this service from a server process are a suspicious command-and-control indicator.

Malicious Kerberos Diamond Ticket Forgery via Rubeus

This rule detects execution of the Rubeus tool with diamond or ticket-request arguments used to forge Kerberos diamond tickets, a technique dissected by Huntress. Attackers decrypt a legitimate TGT and re-sign a modified PAC to impersonate privileged accounts while evading golden-ticket heuristics. Rubeus diamond ticket operations are a high-confidence credential-access and privilege-escalation indicator in Active Directory.

Malicious C2 Communication via cur1-request User-Agent on macOS

This rule detects a process command line containing the misspelled user-agent cur1-request, a distinctive command-and-control string used by BlueNoroff implants in the Web3 macOS intrusion analyzed by Huntress. The malware sets this hardcoded user-agent when beaconing to attacker infrastructure. Because the string is unique to this tooling, its presence is a high-confidence C2 indicator.

Malicious Fake Zoom AppleScript Execution via Osascript

This rule detects osascript executing the zoom_sdk_support AppleScript, an initial access lure used by BlueNoroff in the Web3 macOS intrusion analyzed by Huntress. The threat actor delivers a fake Zoom support script to trick targets into running malicious AppleScript that stages further payloads. Execution of this named script is a high-confidence indicator of the BlueNoroff social-engineering chain.

Suspicious Windows Service Installed with PHP-CLI ImagePath in MagicINFO Path

This rule detects Windows service creation where the ImagePath points to php-cli.exe under the MagicINFO tomcat directory, a persistence mechanism Huntress observed after exploitation of the Samsung MagicINFO 9 server. Attackers register a masqueraded service, often via srvany, to run a PHP interpreter and maintain execution. A service whose binary is a scripting interpreter in an application directory is a strong persistence indicator.

Malicious Registry Hive Theft from Shadow Copy via Print LOLBIN

This rule detects print.exe copying files from a volume shadow copy device path referencing GLOBALROOT, HarddiskVolumeShadowCopy, or a @GMT snapshot UNC path, a LOLBIN abuse technique documented by Huntress for stealing SAM and SYSTEM hives. Attackers use the print utility to read locked credential stores from a shadow copy without triggering hive-export tooling. This file-copy pattern via print.exe is highly anomalous and indicates credential-store theft.

Suspicious PowerShell Out-of-Band Request to Interactsh Domain

This rule detects PowerShell issuing a web request to Interactsh out-of-band domains such as oastify.com or oast.fun, used by attackers to confirm CVE-2025-30406 exploitation against Gladinet CentreStack as reported by Huntress. Adversaries trigger DNS or HTTP callbacks to validate code execution before deploying payloads. Outbound callbacks to out-of-band interaction services from PowerShell strongly indicate exploitation or reconnaissance.

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

This rule detects the IIS worker process w3wp.exe spawning powershell.exe, a web-shell style execution chain observed by Huntress during exploitation of Gladinet CentreStack and Triofox CVE-2025-30406. Attackers leverage a hardcoded machine key ViewState deserialization flaw to run commands as the web application. Because a web worker launching PowerShell is rarely legitimate, this chain is a high-confidence server compromise indicator.

Malicious Volume Shadow Copy Access via Mklink to GLOBALROOT

This rule detects creation of a symbolic link into a GLOBALROOT HarddiskVolumeShadowCopy device path, a technique Huntress observed for reading locked files such as SAM, SYSTEM, and NTDS.DIT from a volume shadow copy. Attackers use the shadow copy to bypass file locks and exfiltrate credential stores. Linking to a shadow copy device object is anomalous and indicates credential-store access.

Malicious NTDS.DIT Extraction via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media set to extract the Active Directory database NTDS.DIT, a domain credential theft technique described by Huntress. Attackers dump NTDS.DIT to obtain every domain account hash for offline cracking and lateral movement. IFM creation outside of planned domain controller promotion is a critical credential-access event.

Malicious Registry Hive Dump via Reg Save for Credential Theft

This rule detects reg.exe saving the SAM, SYSTEM, or SECURITY registry hives to disk, a technique detailed by Huntress for offline extraction of local account password hashes. Attackers export these hives to crack or pass local credentials without touching LSASS. Bulk hive export is rarely legitimate on production hosts and is a high-confidence credential-access indicator.

Suspicious RMM Tool Execution from Windows Temp Directory

This rule detects remote monitoring and management binaries such as AnyDesk, MeshAgent, or SimpleHelp executing from the Windows Temp directory, observed during CrushFTP intrusions by Huntress where RMM tools were silently installed for remote access. Attackers stage RMM agents in temporary directories to establish interactive control while masquerading as legitimate software. RMM execution from a non-standard path is a strong indicator of unauthorized remote access.

Suspicious Domain User Account Created via Net Command

This rule detects use of net.exe to create a new domain user account, observed during CrushFTP post-exploitation by Huntress where an account named vmadmin was added. Adversaries create backup credentials to persist and blend into normal administration. New account creation from interactive shells on servers is an important persistence indicator that should be correlated with the initiating process chain.