Sigma detection rules, expert-reviewed

Suspicious Container Environment Discovery via Proc Cgroup

This rule detects reads of the init process cgroup entry combined with Docker socket probing, the container-awareness discovery JADEPUFFER performs before deciding how to spread and extort. The actor inspects cgroup membership to determine whether it runs inside a container. This reconnaissance precedes container escape and ransomware deployment.

Suspicious Windows Firewall Rule Creation Masquerading as Network Discovery (via process_creation)

This rule detects creation of an inbound Windows firewall rule via netsh using the name Network Discovery SSDP-In to blend in with a built-in rule while opening a high numbered listening port. Velvet Ant used this technique to expose an internal PlugX command and control listener. Adding a rule with this name through netsh is uncommon on normal systems.

Suspicious Security Product Discovery via tasklist and findstr (via process_creation)

This rule detects use of findstr to filter a running process listing for Sophos endpoint agent strings, a discovery step performed after N-able N-central exploitation to check which security products are present before deploying remote management tools and an EDR killer. This behavior indicates an attacker profiling defensive tooling on the host.

Suspicious Domain Trust Discovery via Nltest via Process Creation (via process_creation)

This rule detects nltest.exe enumerating domain trust relationships, the domain reconnaissance SocGholish runs to map an environment per Red Canary. Adversaries use domain trust discovery to plan lateral movement across forests, and nltest /domain_trusts from a non-administrative context is a common early sign of that planning.

Suspicious Whoami Discovery Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects whoami /all discovery executed under a Windows script host parent, the reconnaissance SocGholish performs immediately after its malicious JavaScript runs as emulated by Red Canary. Script hosts collecting user and privilege context are a hallmark of the SocGholish fake-update loader beginning hands-off enumeration of a new victim.

Suspicious Advanced IP Scanner Execution for Network Discovery

This rule detects execution of Advanced IP Scanner, a dual-use network mapping tool frequently staged by ransomware crews to enumerate reachable hosts before lateral movement. The Gentlemen ransomware operators run it during the discovery phase of their intrusions. Detecting it in unexpected contexts can reveal pre-encryption reconnaissance.

Possible Driver Enumeration via Driverquery for Rootkit Discovery

This rule detects execution of the driverquery utility used to enumerate installed kernel drivers. NCC Group observed this discovery step around deployment of the malicious netfilter driver. While the tool is legitimate its use in interactive attacker sessions can indicate reconnaissance for driver based persistence.

Suspicious Domain Controller Discovery via nltest dclist (via process_creation)

This rule detects nltest being used with the dclist option to enumerate domain controllers, part of the chained reconnaissance run before LockBit 3.0 deployment. Attackers map the domain to plan lateral movement and privilege escalation. Domain controller discovery is an early staging action that precedes credential theft and domain-wide encryption.

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

This rule detects the GoAnywhere Tomcat process spawning powershell or cmd running host discovery commands such as whoami and systeminfo. Microsoft observed this chain during active exploitation of CVE-2025-10035 in GoAnywhere Managed File Transfer. A file-transfer web application launching reconnaissance commands indicates post-exploitation hands-on activity.

Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)

This rule detects findstr filtering a running process list for security-vendor process names such as wrsa, opssvc, AvastUI, AVGUI, and bdservicehost, the environment-fingerprinting step used by the GitHub-hosted info stealers delivered through this malvertising campaign. Adversaries enumerate installed defenses to decide whether to proceed or evade before deploying NetSupport and stealer payloads, making this tasklist-and-findstr pattern an early execution indicator.

Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)

This rule detects execution of the Invoke-HuntSMBShares PowerShell cmdlet used to enumerate accessible network shares and their permissions. APT42 ran this PowerHuntShares tooling to map file shares for data collection during their operations. Broad SMB share hunting from PowerShell is a strong network discovery indicator in interactive intrusions.

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating domain trusts, part of the Bazar and Cobalt Strike hands-on-keyboard reconnaissance run by Trickbot, Qbot and Hancitor operators after initial access. Mapping trust relationships helps the operator plan lateral movement across the forest. Nltest trust enumeration is an early sign of post-exploitation activity.

Suspicious System Discovery via WMIC Query Commands (via process_creation)

This rule detects wmic being used with path or list query parameters to enumerate system, operating-system and network configuration details. Adversaries abuse WMIC to profile a compromised host prior to lateral movement, so path and list query usage indicates hands-on discovery activity.

Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID

This rule detects Directory Service search event 1644 with an LDAP filter using the bitwise OID to find accounts trusted for delegation, matching Impacket findDelegation enumeration. Adversaries locate delegation-enabled accounts to abuse constrained or unconstrained delegation for privilege escalation. These specific delegation bit queries are uncommon in routine directory operations.

Suspicious Privilege Discovery Spawned by M365 Copilot Process

This rule detects whoami executed with the /priv argument as a child of M365Copilot.exe, an anomalous parentage observed in a Huntress-investigated Nightmare-Eclipse intrusion where the actor masqueraded execution under a trusted application. The Copilot binary has no legitimate reason to spawn privilege enumeration. This parent-child relationship indicates process masquerading paired with hands-on-keyboard discovery.