Sigma detection rules, expert-reviewed

Suspicious Local XML Compilation via MSBuild

This rule detects MSBuild compiling a project from a non-standard file extension such as xml, used in this pharmaceutical vendor intrusion to run inline C# tasks. MSBuild processing a disguised project file is a trusted-developer-utility abuse technique for executing arbitrary code while evading application controls.

Suspicious Encoded PowerShell DownloadString Execution

This rule detects PowerShell using encoded command flags or an in-memory WebClient DownloadString with Invoke-Expression, the loader behavior in the Confluence CVE-2023-22518 to Cerber ransomware chain. Encoded and download-and-execute PowerShell is a common obfuscated fileless delivery method preceding ransomware deployment.

Suspicious Service Creation Masquerading as Windows Defender

This rule detects creation of a service named windowDefenSrv with sc create, a Defender-lookalike masquerade used for persistence after ActiveMQ exploitation. The deceptive Defender-like name combined with manual service creation is not expected from legitimate security software and signals attacker persistence.

Malicious Remote MSI Install of RuntimeBroker via msiexec

This rule detects msiexec installing a remote RuntimeBroker.msi package over HTTP, the payload delivery used after ActiveMQ exploitation. RuntimeBroker is a legitimate Windows name reused here to disguise a remotely fetched installer, combining masquerading with proxy execution and ingress tool transfer.

Suspicious Shell or Installer Spawned by ActiveMQ Java Process

This rule detects a Java process spawning cmd, msiexec, or PowerShell, the exploitation chain of Apache ActiveMQ CVE-2023-46604 where the broker Java process executed attacker commands. A Java server process launching Windows shells or installers indicates remote code execution against the exposed service.

Suspicious File Download via certutil urlcache

This rule detects certutil downloading a remote file with the urlcache flag, used after WS_FTP exploitation to pull a payload into the Windows Temp directory. Certutil is a certificate utility and its use to fetch content over HTTP is a well known living-off-the-land ingress and proxy download technique.

Suspicious Local Account Creation Named DefaultService

This rule detects creation of a local account named DefaultService via net user /add, a masquerade used by the actor to blend a backdoor account with service naming conventions. New local accounts with deceptive service-like names during an intrusion indicate persistence and should be investigated immediately.

Suspicious Reconnaissance Spawned by wuauclt

This rule detects the Windows Update client wuauclt.exe spawning reconnaissance or shell child processes, an anomalous parent-child relationship seen in the Netscaler exploitation cases. The legitimate update client does not launch discovery utilities, so this pattern indicates process injection or masquerading followed by hands-on-keyboard recon.

Suspicious DLL Execution via rundll32 from PerfLogs Directory

This rule detects rundll32 loading a DLL from the C:\PerfLogs directory, observed in the Netscaler intrusion where the actor ran ch.dll,Start from PerfLogs. PerfLogs is not a normal location for executable DLLs, so rundll32 invocation against it strongly indicates proxied malicious code execution.

Suspicious Command Execution via ComSpec Environment Variable Obfuscation

This rule detects command lines that reference the delayed-expansion ComSpec variable using the exclamation syntax, an obfuscation Raspberry Robin uses when piping junk-laden files into cmd. Legitimate command lines almost never contain this token, making it a reliable indicator of obfuscated batch execution.

Suspicious Remote MSI Installation via msiexec from HTTP URL

This rule detects msiexec installing an MSI package directly from a remote HTTP URL, the core delivery behavior of Raspberry Robin USB malware. Fetching and installing a remote package through the signed msiexec binary is a proxy execution and ingress technique that legitimate installers rarely perform against arbitrary hosts.

Suspicious Remote HTA Execution via mshta from File Sharing Site

This rule detects mshta.exe fetching and executing a remote HTA file, including from the transfer.sh file sharing service as seen in this targeted phishing attack. Loading remote HTA payloads through the signed mshta binary is a proxy execution and defense evasion technique used here to stage an XWorm loader.

Suspicious Domain Admins Enumeration via Net Group

This rule detects enumeration of the Domain Admins group with net group, used by the INC Ransom group to map privileged accounts before privilege escalation. This is a frequent hands-on-keyboard discovery step during intrusions, though it can also appear in benign administration.

Suspicious M365 Sign-In from Synthetic iPhone User Agent via m365

This rule detects Microsoft 365 sign-ins presenting a synthetic iPhone user agent string carrying an implausible Version/26 token. Operators in the Railway PaaS token replay campaign forged iOS user agents when replaying stolen tokens, so this crafted device string is an indicator of non-genuine client access to the tenant.

Suspicious M365 Device Code Authentication Flow via m365

This rule detects Microsoft 365 sign-ins that use the device code authentication flow. The Railway PaaS campaign relied on device code phishing to trick users into authorizing attacker-controlled sessions, so device code grants outside of known kiosk or IoT enrollment scenarios indicate probable phishing-driven token theft.