Sigma detection rules, expert-reviewed

Suspicious curl Download of nvidiadrivers Archive to Temp (via process_creation)

This rule detects curl retrieving an archive named nvidiadrivers.zip into the user temp directory. The Lazarus ClickFake Interview campaign uses this command to stage its payload while masquerading as a legitimate GPU driver update. The specific archive name written to a temporary path with certificate checks disabled indicates malicious staging.

Malicious EC2 Instance Metadata Credential Theft via curl (via process_creation)

This rule detects a command line that curls the EC2 Instance Metadata Service security-credentials path at 169.254.169.254 to steal the temporary IAM role credentials of a compromised instance. Attackers harvest these credentials for reconnaissance, lateral movement, and privilege escalation in the cloud account. Detecting IMDS credential retrieval on a host flags active cloud credential access.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.

Suspicious COM Hijack via CLSID InprocServer32 Pointing to Writable Path (via registry_set)

This rule detects a CLSID InprocServer32 registry value being pointed at a DLL in a user-writable directory such as Temp, AppData or ProgramData. VanHelsing hijacks COM objects by redirecting their server registration to attacker-controlled files, so a CLSID handler in a writable path indicates persistence via COM hijacking.

Malicious EKS Pod Identity Credential Theft via Link-Local Endpoint

This rule detects command line access to the EKS Pod Identity credential endpoint at 169.254.170.23/v1/credentials. Wiz Research demonstrated that a compromised pod can request this URL with a stolen authorization token to retrieve IAM credentials, so direct interaction with this endpoint outside the SDK indicates credential theft.

Malicious Shai-Hulud Bun Payload Execution via npm Preinstall Script (via process_creation)

This rule detects execution of the set_bun.js and bun_environment.js scripts used by the Shai-Hulud 2.0 npm supply chain worm, which are launched from a malicious preinstall entry in package.json to install the Bun runtime and run the worm payload. Adversaries use this staging step to establish execution inside developer and CI environments, so detecting these script invocations exposes a compromised package before credential theft and propagation occur.

Malicious Akira Ransomware Encryptor Execution (via process_creation)

This rule detects execution of the Akira ransomware encryptor invoked with its characteristic path, share and encryption-percentage arguments. Operators launched akira.exe and locker.exe with the -n, -p and -s flags to encrypt local drives and network shares.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Malicious UAC Bypass via SilentCleanup Scheduled Task Trigger

This rule detects schtasks running the built-in SilentCleanup task, the trigger stage of the environment-variable UAC bypass used by NightshadeC2. After hijacking the windir variable the botnet forced SilentCleanup to run so its auto-elevated context executed the attacker payload. On-demand invocation of SilentCleanup via schtasks is a reliable indicator of this UAC bypass.

Malicious Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell, indicative of xp_cmdshell abuse. Estate Ransomware operators enabled xp_cmdshell on a Veeam-linked MSSQL instance to run operating system commands. Command execution from the database engine signals exploitation of the SQL layer.

Suspicious AS-REP Roasting LDAP Search Filter for DONT_REQ_PREAUTH Accounts

This rule detects Directory Service search event 1644 carrying an LDAP filter that uses the bitwise OID to select accounts with the DONT_REQUIRE_PREAUTH flag set, matching Impacket GetNPUsers enumeration for AS-REP roasting. Adversaries query these accounts to request roastable tickets crackable offline. This precise bitwise filter is rarely produced by legitimate directory tooling.

Suspicious macOS Keychain Credential Dump via security Utility (via process_creation)

This rule detects the macOS security command being used to dump keychain contents with the dump-keychain switch and the decrypt flag. Attackers abuse this built-in utility to extract stored passwords and secrets from the user keychain. Requesting a decrypted dump of all keychain items is a hallmark of credential theft on macOS.

Suspicious node.exe or code.exe Execution from Public Music Directory

This rule detects node.exe or code.exe running from the C:\Users\Public\Music directory, where ChaosBot staged a FRP tunneling client and a downloaded VS Code binary. Legitimate Node.js and VS Code do not execute from a Public media folder, so this path indicates staged tooling for tunneling and command execution. The wrong-path execution of dual-use binaries reveals attacker infrastructure on the host.

Malicious Command Shell Spawned by Wing FTP Server Process

This rule detects the Wing FTP server process WFTPServer.exe spawning cmd.exe or powershell.exe, the remote code execution chain Huntress observed during in-the-wild exploitation of CVE-2025-47812. Attackers abuse a null-byte and Lua injection flaw to run arbitrary commands as the FTP service. A command shell parented by the FTP server is rarely legitimate and is a high-confidence exploitation indicator.

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

This rule detects creation of a LaunchAgent property list named GoogleHelperUpdater.plist. The macOS Trojan-Proxy bundled with cracked software installs this masquerading Google-branded LaunchAgent to persist and relay traffic through the victim host, so this plist name in a LaunchAgents directory indicates the proxy implant establishing persistence.