Sigma detection rules, expert-reviewed

Suspicious Windows Defender Exclusion Added via PowerShell Add-MpPreference

This rule detects PowerShell using Add-MpPreference to register a Windows Defender exclusion, observed during post-exploitation of CrushFTP servers by Huntress. Attackers add path or process exclusions to prevent detection of tooling staged under directories such as Windows Temp. Disabling protection coverage before dropping payloads is a common defense-evasion precursor, so unexpected exclusion changes warrant review.

Suspicious Command Interpreter Spawned by Cleo Java Process

This rule detects the Cleo Java runtime spawning PowerShell or a command shell, the exploitation signature of active in-the-wild attacks against Cleo Harmony and related file transfer products under CVE-2024-55956. The vulnerable autorun mechanism executes attacker-supplied commands through the Java process. A Java service launching an interpreter indicates successful remote code execution on the server.

Suspicious Curl Download Spawned by PowerShell

This rule detects the curl client spawned as a child of PowerShell, an anomalous chain used to fetch second-stage tooling after an initial PowerShell foothold. Legitimate curl usage is rarely launched by an interactive PowerShell session. This process lineage indicates scripted download activity during post-exploitation.

Suspicious Download or Exfiltration via Finger LOLBin

This rule detects execution of the legacy finger client, an uncommon living-off-the-land binary that attackers repurpose to download payloads and exfiltrate data over the finger protocol. Its use in modern Windows environments is almost always malicious. Finger-based transfers move data across the network while blending with rarely inspected protocol traffic.

Suspicious Free Space Wiping via Cipher

This rule detects the cipher utility invoked with the wipe switch to overwrite deallocated disk space, destroying recoverable data. The ReadText34 ransomware operators ran cipher to hinder forensic recovery after encryption. Free-space wiping is an anti-recovery and anti-forensics action associated with the impact phase of ransomware.

Suspicious Svchost Masquerading Binary with Network Connect Flag

This rule detects execution of a binary named svhost.exe, a deliberate misspelling of the legitimate svchost service host, used to run a BianLian backdoor during the ReadText34 ransomware incident. The impostor process reached out with a connect flag to attacker command and control. A svchost look-alike executing from a non-system path is a strong masquerading indicator.

Suspicious Boot Configuration Change Disabling Integrity Checks

This rule detects bcdedit modifying boot load options to disable driver signature integrity checks, a prerequisite for loading unsigned or malicious kernel drivers. This was observed in the ReadText34 ransomware incident alongside bring-your-own-vulnerable-driver activity. Disabling integrity checks lets attackers load kernel-level tooling to tamper with security controls.

Suspicious Command Shell Spawned by MSSQL Server Process

This rule detects the SQL Server service process spawning a command shell or PowerShell, the behavioral signature of xp_cmdshell abuse observed in intrusions against Foundation accounting software. Attackers brute forced exposed database accounts and enabled xp_cmdshell to run operating system commands. Command execution from the database engine indicates hands-on-keyboard post-exploitation.

Suspicious Named Pipe Creation via Command Echo

This rule detects a command shell echoing data into a named pipe device path, a covert local inter-process channel used by an APT targeting Vietnamese human rights defenders for command output relay. Writing to the pipe device path from cmd is atypical of normal administrative activity. Named pipe abuse supports stealthy internal command and control and privilege operations.

Suspicious Scheduled Task Creation with Recurring Minute Interval

This rule detects creation of a scheduled task that recurs every 300 minutes via schtasks, matching persistence tasks used by an APT targeting Vietnamese human rights defenders. The actor masqueraded these tasks to blend with legitimate system activity. Recurring scheduled tasks provide durable persistence and periodic re-execution of implants.

Suspicious Security Product Process Termination via Named Utility

This rule detects command-line termination of the Cylance security service process, observed when INC ransomware operators killed endpoint protection to evade defenses. The command references the CylanceSvc.exe process together with a kill or process-target flag. Disabling running security products is a precursor to unimpeded lateral movement and encryption.

Suspicious Rclone Data Exfiltration with Include Filter

This rule detects use of the rclone cloud copy utility with an include-from filter list to selectively stage and exfiltrate files. Operators behind the INC ransomware intrusion used rclone to copy targeted data to attacker-controlled cloud storage prior to encryption. Selective bulk copying to cloud storage is a strong indicator of pre-ransomware data theft.

Suspicious Windows Defender Disabling via SystemSettingsAdminFlows

This rule detects abuse of the legitimate SystemSettingsAdminFlows binary to disable Windows Defender protections from the command line. This tradecraft was observed in an intrusion that escalated from LOLBin abuse to INC ransomware deployment, where operators disabled defenses before staging and encryption. Blinding endpoint protection precedes data theft and ransomware and warrants immediate review.

Certutil Decoding Encoded Payload to Executable

This rule detects certutil.exe invoked with the decode option to convert an encoded file back into an executable, a deobfuscation step that evades content inspection of the transferred payload. Huntress observed this after a compromised MSSQL host fetched a PHP-served payload and reconstructed it on disk. Using certutil to decode files is a well-known living-off-the-land technique for payload staging.

Restic Backup Tool Exfiltration to Cloud Object Storage

This rule detects the restic backup utility or its environment variables being used together with a cloud object storage endpoint such as Backblaze B2 or Wasabi. Huntress observed operators abusing restic, sometimes renamed to dns.exe, to back up and exfiltrate victim data to attacker-controlled buckets. Pairing backup tooling with third-party object storage destinations indicates data theft rather than sanctioned backup.