Sigma detection rules, expert-reviewed

Malicious Mimikatz Credential Dumping via Command Line Arguments

This rule detects execution of Mimikatz through its characteristic privilege debug and logonpasswords module arguments as seen in the ScreenConnect to Hive ransomware case where the actor dumped cleartext credentials from LSASS and this matters because these command sequences are unique to credential theft tooling and precede rapid domain wide compromise.

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Malicious SharePoint ToolPane Exploitation via SignOut Referer

This rule detects HTTP POST requests to ToolPane.aspx carrying a Referer header pointing at SignOut.aspx. This exact request pattern is the authentication bypass used to exploit the SharePoint ToolShell vulnerabilities. The crafted Referer combined with the ToolPane endpoint is a reliable exploitation signature.

Malicious Kazuar Backdoor C2 via Hardcoded HTTP Cookie by Pensive Ursa

This rule detects outbound HTTP traffic carrying the hardcoded Cookie value used by the upgraded Kazuar .NET backdoor attributed to Pensive Ursa (Turla). The backdoor beacons with a static cookie GUID that identifies its command and control channel which makes it a high fidelity indicator of an active Turla implant.

Malicious Ransomware Encryption Extension x2anylock

This rule detects files being created or renamed with the .x2anylock extension. The ransomware deployed in the Project AK47 campaign appends this extension to encrypted files. Mass creation of .x2anylock files is a definitive indicator of active ransomware encryption.

Malicious PowerShell UrlDecode Payload Spawned by SQL Server after FortiClient EMS Exploitation

This rule detects a command shell launching PowerShell that loads System.Web and calls UrlDecode as a child of the SQL Server process. Attackers exploiting the patched FortiClient EMS vulnerability use this chain to decode and run staged payloads through the exposed database service. A SQL Server process invoking encoded PowerShell indicates post-exploitation code execution.

Malicious SUNBURST Named Pipe Creation

This rule detects creation of the named pipe used by the SUNBURST backdoor as a single-instance mutex during SolarWinds supply-chain intrusions. The pipe name is a unique campaign constant with no legitimate use. Its presence confirms SUNBURST execution on the host.

Malicious SUNBURST avsvmcloud.com C2 DNS Query

This rule detects DNS queries to the avsvmcloud.com domain used by SUNBURST for command-and-control via DGA-generated subdomains resolved through CNAME records. The command-and-control domain is a meaningful campaign constant. Any resolution attempt indicates a compromised SolarWinds Orion host beaconing to the adversary.

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Malicious BlackSuit Ransomware Execution via Process Creation

This rule detects the distinctive command-line flags of BlackSuit ransomware combining virtual machine termination, full-file encryption, and a victim identifier. This flag combination is unique to the BlackSuit encryptor and signals an active encryption run.

Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint

This rule detects a POST request to the SharePoint ToolPane endpoint in edit mode with a referer set to the SignOut page, the exact exploitation pattern of the ToolShell on-premises SharePoint vulnerabilities. This unauthenticated request chain is used to forge ViewState and achieve remote code execution and should be treated as active exploitation.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

This rule detects the IIS process inetinfo.exe loading wmicodegen.dll, a DLL sideloading technique UAT-8099 uses to run Cobalt Strike on compromised web servers. The inetinfo.exe process has no legitimate reason to load this library. This load indicates in-memory beacon deployment via search-order hijacking.

Malicious Dynamicweb Unauthenticated Administrator Creation via Setup Default.aspx (via webserver)

This rule detects requests to the Dynamicweb Access Setup Default.aspx page invoking the createadministrator action with adminusername and adminpassword parameters. This logic flaw in Dynamicweb 9.5.0 through 9.12.7 lets an unauthenticated attacker create an administrator account and then upload an ASPX webshell for RCE. Detecting it surfaces account creation abuse leading to full server compromise.