Sigma detection rules, expert-reviewed

Malicious macOS LaunchAgent Persistence com.nvm.protocal.plist

This rule detects creation of a LaunchAgent property list named com.nvm.protocal.plist, the macOS persistence dropped by the Mastra npm supply chain compromise. The plist impersonates a Node version manager helper to relaunch the malicious payload at every user login.

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

This rule detects a command writing the OVERSTEP shared object into /etc/ld.so.preload to hook every dynamically linked process on a SonicWall SMA appliance. This LD_PRELOAD rootkit hides attacker files and processes while capturing credentials, cementing long-term stealthy access after public-facing exploitation.

Malicious Local Administrator Account Creation via CherryLoader (via process_creation)

This rule detects creation of a local account named Administrater, a misspelled account name hardcoded in the CherryLoader persistence batch script. The loader created this account and added it to the local administrators group for persistent access.

Malicious Windows Event Log Clearing via PowerShell

This rule detects Windows event log clearing performed through PowerShell log-management methods, an anti-forensic action Qilin ransomware used to wipe event logs during its intrusion. Programmatic clearing of event logs is rarely legitimate and typically indicates an adversary covering tracks.

QBot scheduled task REGSVR32 with C$ image path

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Suspicious Cron Job Executing Binary From var tmp via Process Creation

This rule detects a cron daemon spawning a process from the /var/tmp directory. The trojanized Free Download Manager installs an /etc/cron.d/collect job that runs /var/tmp/crond every ten minutes, using cron to persist and periodically launch its reverse-shell payload from a world-writable path.

Suspicious Cloudflared Tunnel Execution via Renamed svchost Binary

This rule detects a process named svchost.exe running Cloudflare tunnel arguments from outside the System32 directory, matching the renamed cloudflared tunnel used by the RMMProject operators for covert C2 access. Adversaries rename cloudflared to svchost.exe to blend in while establishing an outbound tunnel. A svchost image running tunnel arguments from a non-system path is anomalous and indicates masqueraded tunneling.

Suspicious Bash Reverse Shell via /dev/tcp

This rule detects Bash command lines that redirect a shell to a /dev/tcp socket, a fileless reverse-shell technique. This was used against Linux and SAP hosts following CVE-2025-31324 exploitation to obtain interactive remote access. Legitimate administrative use of /dev/tcp is uncommon and warrants investigation.

Malicious Auto-Color Backdoor Self-Copy on Linux (via process_creation)

This rule detects references to the /var/log/cross/auto-color path where the Auto-Color Linux backdoor copies itself for persistence while masquerading inside a log directory. Placing an executable under /var/log is an evasive persistence technique meant to avoid scrutiny of typical binary locations.

Malicious RDP Session Hijack via Service Creation Abuse (via security)

This rule detects create a service that triggers TSCON in order to preform local RDP session hijack.

Malicious Netcat Reverse Shell with Command Execution Flag (via process_creation)

This rule detects netcat launched with the -e flag to pipe a shell to a remote endpoint. Actors exploiting F5 BIG-IP and ScreenConnect used nc -e /bin/bash to obtain interactive reverse shells on compromised hosts. The -e execution flag combined with a shell path is a well-established reverse-shell indicator.

Malicious NTDS Database Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating a full copy of the Active Directory database, the credential theft step Volt Typhoon performs to obtain the domain NTDS.dit file and all account hashes. Dumping the directory database enables offline cracking and domain wide impersonation, so this operation on a domain controller is a high confidence indicator of hands on keyboard credential access.

Possible FortiGate RCE via Chunked hostcheck_validate Request (CVE-2024-21762)

This rule detects POST requests to the FortiGate SSL VPN hostcheck_validate endpoint using Transfer-Encoding chunked, matching the out-of-bounds write exploited in CVE-2024-21762 as analyzed by Assetnote. The exploit relies on a malformed chunked body with a zero-length terminator and excess trailer lines to corrupt memory and reach code execution. Detecting chunked requests to this specific endpoint surfaces attempts against the vulnerable parser.

Malicious AMSI Bypass via PowerShell amsiInitFailed Patch

This rule detects PowerShell reflection that flips the AMSI amsiInitFailed field to disable in-memory script scanning. Fake browser update chains delivering BitRAT and Lumma Stealer used this to blind AMSI before reflective .NET loading. Disabling AMSI removes a primary defense against staged malicious payloads.

Suspicious Windows Service Executing Batch File from Temp Directory

This rule detects Windows service creation whose ImagePath runs cmd.exe against a batch file staged in a temp directory, observed by Huntress where a masquerading service named WebrootCheck launched a batch file from c colon temp. Attackers register a legitimate-looking service to execute attacker scripts with SYSTEM privileges and persist. A service that runs a temp-directory batch file combines a benign-looking name with a suspicious execution context and is a strong persistence indicator.