Sigma detection rules, expert-reviewed

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

This rule detects reconfiguration of the Update Orchestrator Service binary path via sc.exe, the abuse chain behind CVE-2019-1322 that runs an attacker command as SYSTEM. Repointing UsoSvc to an arbitrary command lets a low-privileged user escalate to SYSTEM when the service restarts.

Suspicious Command Prompt Spawned by Winlogon

This rule detects winlogon.exe spawning cmd.exe, an anomalous parent-child relationship used by Backdoor.Stupig to run a SYSTEM command prompt on the secure logon desktop. Winlogon rarely launches an interactive shell.

Suspicious DNS Zone Enumeration via dnscmd

This rule detects dnscmd.exe enumerating or printing DNS zones, a discovery technique used by espionage actors against Asian governments to map internal hosts and infrastructure from a compromised DNS server.

Possible UAC Bypass via ms-settings Shell Open Command Hijack (via registry_set)

This rule detects modification of the ms-settings shell open command registry value under HKCU which is the fodhelper.exe auto-elevation UAC bypass. Lunar Spider used this technique to elevate privileges without a consent prompt. The registry hijack redirects a trusted auto-elevating binary to run an attacker-controlled command with high integrity.

Suspicious Base64 Decode Piped to Python Interpreter

This rule detects base64 decoding of a staged file piped into a Python interpreter, an obfuscated execution step observed in the AI agent-driven container escape. Encoding payloads and decoding them into an interpreter hides malicious code from simple string inspection. This chain indicates defense-evasion around payload execution.

OpenSSH Server Firewall Configuration on Windows - PowerShell (via powershell)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

Malicious Unsigned libConfigurer64 Dylib Side-Loading via Image Load

This rule detects loading of the libConfigurer64 dylib which pirated macOS applications side-load to execute the bundled Khepri implant. This uniquely named unsigned library is the loading mechanism of the campaign so its appearance indicates a trojanized pirated app running malicious code.

Malicious BlackByte Ransomware Host Marker via Control Panel Registry

This rule detects the international control panel values s1159 and s2359 being set to BLACKBYTE, a distinctive host-marking artifact created by BlackByte ransomware. BlackByte writes this value to tag infected systems.

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects in the wild exploitation of Fortinet FortiWeb CVE-2025-64446 where a request to the cmdb API traverses the path to the internal fwbcgi handler to bypass authentication and create administrative users. The combination of the cgi-bin fwbcgi target and directory traversal is a reliable exploitation marker.

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

This rule detects DNS lookups for the dnslog.store out of band interaction service, which attackers query to confirm successful exploitation and command injection during mass vulnerability scanning. Enterprise hosts have no legitimate reason to resolve this canary domain, so such queries indicate reconnaissance or validated exploitation of an internet facing device.

Malicious Event Log Service Disabled via sc.exe (Soco404 Cryptomining)

This rule detects sc.exe stopping the Windows event log service, an anti forensic action used by the Soco404 cryptomining campaign to blind defenders. It is important because stopping event logging removes the primary source of endpoint telemetry during active intrusion.

Malicious macOS LaunchDaemon Persistence Masquerading as Finder Helper

This rule detects creation of a LaunchDaemon property list named com.finder.helper.plist, the persistence artifact dropped by the AMOS stealer masquerading as a legitimate Finder helper. Registering this plist establishes root-level persistence that survives reboots. The fake Finder helper label is a known AMOS masquerade and is not a genuine Apple daemon.

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

This rule detects command lines invoking SharpDPAPI machine masterkey or machine credential functions, the tooling used to recover machine-scoped DPAPI keys and ultimately active ADFS signing keys in the observed intrusion. Adversaries extract these keys to decrypt protected secrets and forge SAML tokens for cloud access, so SharpDPAPI machine operations are a high-fidelity credential access indicator.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.