Sigma detection rules, expert-reviewed

BlackCat ALPHV Ransomware Execution With access-token Argument

This rule detects a process launched with the --access-token argument required by the BlackCat ALPHV ransomware encryptor to unlock and run. Huntress observed affiliates passing this token to detonate the payload on compromised hosts. The mandatory access-token flag is a distinctive execution signature that separates this ransomware from benign tooling.

WMI Event Consumer Persistence Named System__Cmr

This rule detects references to the WMI event consumer name System__Cmr, a persistence artifact created during ScreenConnect post-exploitation to re-execute payloads on system events. Huntress recovered this named consumer as an operator-specific persistence mechanism. The distinctive consumer name is a reliable indicator of this intrusion set installing WMI-based persistence.

Windows Defender Exclusion Path Added via Add-MpPreference

This rule detects PowerShell adding a Windows Defender exclusion path with Add-MpPreference, a defense-evasion step that lets subsequent payloads run without antivirus inspection. Huntress observed this during ScreenConnect post-exploitation to shield dropped tooling. Attacker use typically excludes staging directories immediately before payload delivery.

Exchange Worker Process Spawning Command Shell via OWASSRF

This rule detects the IIS Exchange worker process w3wp.exe spawning cmd.exe or PowerShell, a hallmark of web-facing exploitation such as the OWASSRF Exchange remote code execution chain. Huntress observed base64-encoded PowerShell whoami commands launched this way for post-exploitation reconnaissance. Shell children of the Exchange worker almost always indicate a webshell or server-side request forgery exploit.

Silent AnyDesk Remote Access Tool Installation

This rule detects AnyDesk executed with an install flag, indicating an unattended deployment of the remote access tool. Huntress observed adversaries installing AnyDesk on compromised MSSQL servers to maintain hands-on access. Silent RMM installation on servers is a common attacker persistence and command-and-control technique that blends with legitimate remote support tooling.

Suspicious BCP Data Staging to Public Music Directory

This rule detects the SQL Server bulk copy utility bcp.exe writing query output to the Public Music directory, a staging location used by operators who breached exposed MSSQL servers. Huntress observed this technique to drop payloads and stage data after xp_cmdshell abuse. Writing bcp query output to a world-writable public folder is a strong signal of post-exploitation tooling rather than administration.

Suspicious Remote MSI Install of Dokan Driver via msiexec

This rule detects msiexec installing a Dokan filesystem package, the driver this threat actor deployed to mount a virtual drive for credential and data staging. Dokan has legitimate uses in some software, so this pattern is a low-confidence signal best correlated with subsequent dokanctl mounting and LSASS access.

Suspicious Dokan Filesystem Driver Mount via dokanctl

This rule detects use of dokanctl to install or mount a Dokan user-mode filesystem, which this actor used to mount a virtual drive for staging an LSASS memory dump and collected data. The Dokan control utility is uncommon in enterprise environments and its use during an intrusion warrants investigation of the mounted volume.

Suspicious Data Exfiltration via finger to Remote Host

This rule detects execution of the legacy finger client against a remote host, abused in this case to exfiltrate directory and task listings and to pull down content over TCP port 79. The finger utility has virtually no legitimate use on modern Windows, so its execution against an external host indicates a living-off-the-land exfiltration or download channel.

Suspicious Event Log Clearing via PowerShell Invoke-Expression

This rule detects PowerShell clearing Windows event logs, used in the SysAid intrusion to remove traces of activity. Programmatic event log clearing is a strong indicator of anti-forensic defense evasion following a compromise.

Suspicious Security Product Enumeration via tasklist

This rule detects tasklist enumeration filtered for security product names such as Sophos, used after SysAid exploitation to check for endpoint defenses. Process discovery targeting security tooling is a common pre-attack step to plan defense evasion.

Suspicious PowerShell Spawned by SysAid Java Process

This rule detects the SysAid Java process spawning PowerShell, the exploitation behavior of CVE-2023-47246 where a WAR webshell led to PowerShell execution. The SysAid application server launching PowerShell indicates remote code execution through the vulnerable service.

Suspicious File Download via PowerShell WebClient DownloadFile

This rule detects PowerShell downloading files with WebClient DownloadFile, used to retrieve an MSI and a malicious MSBuild XML in this campaign. This is a common ingress tool transfer method that, while occasionally used by administrators, frequently indicates payload staging.

Suspicious Remote HTA Execution via mshta over HTTP

This rule detects mshta.exe executing a remote HTA over HTTP, used in this intrusion to reach an attacker command-and-control server. Remote HTA execution through the signed mshta binary is a proxy execution technique that legitimate applications do not require.

Suspicious Local XML Compilation via MSBuild

This rule detects MSBuild compiling a project from a non-standard file extension such as xml, used in this pharmaceutical vendor intrusion to run inline C# tasks. MSBuild processing a disguised project file is a trusted-developer-utility abuse technique for executing arbitrary code while evading application controls.