Sigma detection rules, expert-reviewed

Suspicious M365 Sign-In from Programmatic Password Spraying User Agent

This rule detects Microsoft 365 sign-in activity presenting user agents associated with programmatic HTTP libraries and password spraying frameworks such as Axios, python-requests, CredMaster, and TREVORspray. These clients drive automated credential attacks against cloud identities from non-interactive infrastructure. Programmatic sign-in agents against user accounts indicate credential stuffing or spraying rather than legitimate browser access.

Suspicious Inbox Rule Hiding Mail to Deleted Items via M365 Exchange

This rule detects inbox rules that match on the @ character and move matching messages to the Deleted Items folder in Microsoft 365. This behavior was used in the Huntress traitorware intrusion to hide reply and alert traffic, a common business email compromise evasion technique that conceals ongoing mailbox abuse from the legitimate user.

Suspicious jli.dll Sideloading by Non-Java Trusted Binary

This rule detects loading of jli.dll from a user-writable or temporary directory, the DLL sideloading vector observed in the Matanbuchus and AstarionRAT chain where a signed Java launcher was abused to load a malicious jli.dll. Placing an attacker DLL beside a trusted executable causes it to be loaded with the host binary's trust. Loading jli.dll from outside a legitimate Java runtime path indicates search-order hijacking.

Malicious DLL Sideload via SentinelBrowserNativeHost

This rule detects SentinelBrowserNativeHost.exe loading SentinelAgentCore.dll from a directory outside the legitimate SentinelOne installation path, indicating DLL sideloading used to run Cephalus ransomware loader code under a trusted signed binary. The rogue DLL pairs with a data.bin payload to decrypt and execute the ransomware. Abusing a security vendor binary for sideloading evades trust-based defenses.

Suspicious version.dll Sideloading via ADExplorer

This rule detects the Sysinternals ADExplorer binary loading a version.dll from outside the System32 directory, the DLL search order hijack the actor used to sideload malicious code. A trusted signed tool loading a non-system version.dll from its working directory is a classic sideloading pattern rather than normal execution.

Malicious macOS LaunchAgent Persistence via Masqueraded com.apple hcpi Property List

This rule detects creation of a LaunchAgent property list that masquerades as an Apple system component using a com.apple prefix combined with an hcpi identifier. The MacSync RAT reverse engineered by Huntress installed persistence as a com.apple.<hex>.hcpi.plist LaunchAgent to survive reboots while blending in with legitimate Apple agents. The mismatch between the trusted-looking name and the user-writable LaunchAgents path is a strong persistence indicator.

Suspicious Hosts File Modification to Block Security Vendors via file_event

This rule detects writes to the Windows hosts file at drivers\etc\hosts. The Dragon Boss PUP edited this file to null-route antivirus and security vendor domains so protection tools could not update or communicate, so unexpected modification of the hosts file indicates an attempt to sever endpoint defenses.

Suspicious Application Config File Dropped Beside Trusted .NET Binary for App Domain Manager Injection

This rule detects creation of an application configuration file with the .exe.config extension in a user-writable location, the delivery step for App Domain Manager injection where the config redirects a trusted signed .NET binary to load an attacker assembly. The config declares an appDomainManagerAssembly that the runtime honors on startup, executing attacker code under the trusted process. A dropped .exe.config in a temporary or user directory beside a signed binary is a strong hijack indicator.

Suspicious Keylogger Capture Database Written to macOS Temp Directory

This rule detects creation of google_cache.db under a macOS temp directory such as private tmp, the collection store used by the BlueNoroff keylogger and screen capture module analyzed by Huntress. The implant records keystrokes and screenshots into this disguised database before exfiltration. A capture database with a browser-cache-like name in a temp path is a strong collection indicator.

Malicious Telegram Update LaunchDaemon Persistence on macOS

This rule detects creation of a LaunchDaemon property list masquerading as a Telegram updater such as com.telegram2.update.agent.plist, a persistence mechanism used by BlueNoroff as analyzed by Huntress. Attackers install a LaunchDaemon with a trustworthy-sounding label to run their implant at boot. A LaunchDaemon impersonating a Telegram update service is a strong macOS persistence indicator.

Suspicious Cleo Autorun Healthcheck File Creation

This rule detects creation of the healthcheck and healthchecktemplate autorun files that Cleo software processes to trigger command execution, the entry point abused in active exploitation of CVE-2024-55956. Attackers drop these files into the monitored autorun directory to run malicious payloads. Their creation on a Cleo host indicates an exploitation attempt against the file transfer service.

Malicious Akira Ransomware Ransom Note Creation

This rule detects creation of the Akira ransomware ransom note akira_readme.txt on disk. Akira writes this note across encrypted directories as part of its extortion workflow. Ransom note creation confirms active or completed encryption on the host and demands immediate response.

Malicious INC Ransomware Ransom Note Creation

This rule detects creation of the INC ransomware ransom note file INC-README.txt on disk. INC ransomware writes this note across encrypted directories during and after the encryption phase. Ransom note creation is a high-confidence indicator that encryption is underway or complete on the host.

ScreenConnect Administrator Provisioning XML Written to Temp Directory (CWE-288)

This rule detects XML files written under the Windows Temp ScreenConnect directory, where exploitation of the ConnectWise authentication bypass (CWE-288) drops a temporary User definition to provision a rogue administrator. Huntress observed newly created admin entries with null default login dates confirming abuse. Any XML staged in this temp path during setup indicates unauthorized account creation via the vulnerability.

Malicious INC Ransom Ransom Note File Creation

This rule detects creation of files ending in inc-readme.txt, the ransom note dropped by the INC Ransom group after encryption. Widespread creation of this note filename across a host indicates active ransomware impact and demands immediate response.