Sigma detection rules, expert-reviewed

Malicious PowerShell Download From Storjshare With UAC Elevation via OXLoader

This rule detects PowerShell downloading a payload from the storjshare distribution service and relaunching it with RunAs to trigger UAC elevation as used by the OXLoader loader delivering CASTLESTEALER in Elastic research. Combining a remote fetch with an elevation prompt indicates the loader staging its next component with administrative rights.

In-Memory Offensive PowerShell Tooling Cmdlet Usage (via process_creation)

This rule detects command lines that reference offensive PowerShell tradecraft such as Invoke-Mimikatz, PowerView, Invoke-Kerberoast or Get-Keystrokes, revealing use of red-team frameworks for credential access, discovery and post-exploitation. Weaponized PowerShell is the most prevalent technique in the Red Canary Threat Detection Report, and these function names are strong indicators of adversary tooling loaded in memory. Detecting the cmdlet names surfaces the activity even when the payload is fileless.

Suspicious Run Key Referencing Alternate Data Stream Payload

This rule detects an autorun value whose data references an alternate data stream on the user profile. Gamaredon hides GammaPhish payloads in named streams such as USERPROFILE GTR and points a Run entry at them for stealthy persistence. Autorun values pointing into alternate data streams are a strong sign of hidden payload persistence.

Suspicious APT37 Persistence via MicrosoftUpdate Scheduled Task From ProgramData (via process_creation)

This rule detects APT37 creating a scheduled task named MicrosoftUpdate that repeatedly executes a payload staged in the ProgramData directory every few minutes. The masquerading task name paired with a ProgramData executable indicates the Rustonotto loader.

Malicious Exchange Transport Agent Installation Artifacts - Native (via msexchange-management)

This rule detects load an artifact in the Exchange transport agent.

Malicious PrintNightmare Privilege Escalation via Invoke-Nightmare

This rule detects the Invoke-Nightmare PowerShell cmdlet used to exploit the PrintNightmare vulnerability for local privilege escalation, as observed in SnapMC intrusions before data theft. Invocation of this public exploit tooling reliably indicates an attempt to gain SYSTEM privileges through the print spooler.

Malicious Named Pipe Netcat Reverse Shell via Shell (via process_creation)

This rule detects a reverse shell built from a named pipe relayed through netcat on Linux hosts. The marimo blockchain botnet campaign used mkfifo and nc to relay an interactive shell back to attacker infrastructure. This combination of a fifo and netcat is a well known reverse shell construct that warrants immediate investigation.

Suspicious Service NetDnsActivatorSharing Creation via Process Creation

This rule detects creation of a Windows service named NetDnsActivatorSharing via sc.exe, a persistence artifact of the GoldenJackal air-gapped toolset. The name imitates a plausible networking service to evade casual review. This indicates service-based persistence by an espionage actor targeting isolated networks.

Malicious BYOVD Driver Signed by Revoked Certificate Load (via image_load)

This rule detects the loading of a kernel driver signed with the revoked or expired certificates reused by the AVKiller EDR killer shared across multiple ransomware operators. The driver carries a randomized name and fake CrowdStrike version information but is signed by the revoked Changsha Hengxiang or expired Fuzhou Dingxin certificates, a strong indicator of bring your own vulnerable driver abuse.

Malicious Reverse Tunnel Agent Execution with Hidden Server Flags

This rule detects execution of agent.exe with -server and -hide command-line flags, the reverse tunnel implant used in a Huntress-investigated Nightmare-Eclipse intrusion that connected to staybud.dpdns.org over port 443. The -hide flag conceals the agent window while -server points to the attacker relay, establishing a yamux-based reverse tunnel. This flag combination reflects covert command-and-control tunneling.

Malicious PeerBlight Command and Control Beacon to qtss.cc Domain

This rule detects DNS resolution of the qtss.cc domain, the ZinFoq command and control infrastructure contacted by the PeerBlight Linux backdoor for beaconing. Resolution of this domain indicates an infected host reaching out to attacker-controlled C2. The domain is a known PeerBlight indicator and has no legitimate business use.

Suspicious KeePass Configuration Discovery via PowerShell Script

This rule detects execution of the Find-KeePassConfig PowerShell function, used by the ransomware actor Storm-0501 to locate KeePass password database configuration files for credential theft. Discovering KeePass configs is a precursor to extracting master keys and stored secrets from password vaults.

Malicious LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, a LOLBIN LSASS dumping technique documented by Huntress. Attackers first resolve the LSASS process id via tasklist and then dump its memory to harvest plaintext credentials and hashes. Because comsvcs MiniDump has no legitimate administrative use, this is a high-confidence credential-theft signal.

Suspicious NightSpire Encryptor Execution Producing nspire Extension via process_creation

This rule detects execution of the enc.exe encryptor associated with NightSpire ransomware or command lines referencing the .nspire extension it appends. This activity represents the encryption stage of the intrusion where victim files are locked, and its detection enables rapid response to limit ransomware impact.

Suspicious Python Backdoor Staging in SystemServices Folder (via file_event)

This rule detects creation of a Python script named svc.py inside a SystemServices directory under the local application data path. The DEEP#DOOR campaign staged its Python backdoor and credential stealer at this location.