The most recently added or modified critical-severity Sigma detection rules from the SigmaHQ repository.https://cerez23.github.io/enhttps://cerez23.github.io/sigma-rule-library/rules/b2e4a719-3c8f-4d1b-a507-f83c2d56e901/https://cerez23.github.io/sigma-rule-library/rules/b2e4a719-3c8f-4d1b-a507-f83c2d56e901/Detects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without requesting a TGT - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from a non-DC host - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a Kerberos ticket and is authenticating from a non-DC host - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost): attacker obtained a DC certificate via ADCS CDC-chase abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync (severity: critical)Wed, 29 Jul 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a/https://cerez23.github.io/sigma-rule-library/rules/c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a/Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence. (severity: critical)Sun, 19 Jul 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/0e7163d4-9e19-4fa7-9be6-000c61aad77a/https://cerez23.github.io/sigma-rule-library/rules/0e7163d4-9e19-4fa7-9be6-000c61aad77a/Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles (severity: critical)Thu, 18 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/101a1877-2cf4-474d-abfd-7f6ac4788d1a/https://cerez23.github.io/sigma-rule-library/rules/101a1877-2cf4-474d-abfd-7f6ac4788d1a/Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: critical)Mon, 15 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/238527ad-3c2c-4e4f-a1f6-92fd63adb864/https://cerez23.github.io/sigma-rule-library/rules/238527ad-3c2c-4e4f-a1f6-92fd63adb864/Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: critical)Mon, 15 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/78cc2dd2-7d20-4d32-93ff-057084c38b93/https://cerez23.github.io/sigma-rule-library/rules/78cc2dd2-7d20-4d32-93ff-057084c38b93/Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset. (severity: critical)Mon, 15 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/4c6ca276-d4d0-4a8c-9e4c-d69832f8671f/https://cerez23.github.io/sigma-rule-library/rules/4c6ca276-d4d0-4a8c-9e4c-d69832f8671f/Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: critical)Mon, 15 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/97233998-3838-4581-88c6-f1d19d3993fb/https://cerez23.github.io/sigma-rule-library/rules/97233998-3838-4581-88c6-f1d19d3993fb/Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: critical)Mon, 15 Jun 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b/https://cerez23.github.io/sigma-rule-library/rules/9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b/Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution. (severity: critical)Fri, 17 Apr 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c/https://cerez23.github.io/sigma-rule-library/rules/a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c/Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool. RedSun works as follows: 1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\ 2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt 3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file 4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open 5. During the oplock break window, RedSun swaps the mount point (junction) to redirect \\?\C:\Windows\System32 to the attacker-controlled temp path 6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges (severity: critical)Fri, 17 Apr 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d/https://cerez23.github.io/sigma-rule-library/rules/f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d/Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains the RS- prefix characteristic of RedSun's staging directory (e.g. %TEMP%\RS-{GUID}\TieringEngineService.exe). RedSun registers a Cloud Files sync root under this RS-prefixed path and drops a masqueraded placeholder there as part of its oplock-based AV bypass and privilege escalation chain. The RS-{GUID} directory name is generated by RedSun itself and has no legitimate system usage, making the combination of this path prefix and the TieringEngineService.exe filename a highly specific indicator of RedSun activity. (severity: critical)Fri, 17 Apr 2026 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/c0d3734d-330f-4a03-aae2-65dacc6a8222/https://cerez23.github.io/sigma-rule-library/rules/c0d3734d-330f-4a03-aae2-65dacc6a8222/Detects possible command execution by web application/web shell (severity: critical)Fri, 05 Dec 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/f1531fa4-5b84-4342-8f68-9cf3fdbd83d4/https://cerez23.github.io/sigma-rule-library/rules/f1531fa4-5b84-4342-8f68-9cf3fdbd83d4/Detects potential Dtrack RAT activity via specific process patterns (severity: critical)Mon, 03 Nov 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/7aa7009a-28b9-4344-8c1f-159489a390df/https://cerez23.github.io/sigma-rule-library/rules/7aa7009a-28b9-4344-8c1f-159489a390df/Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks. (severity: critical)Tue, 21 Oct 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/91048c0d-5b81-4b85-a099-c9ee4fb87979/https://cerez23.github.io/sigma-rule-library/rules/91048c0d-5b81-4b85-a099-c9ee4fb87979/Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm (severity: critical)Sun, 19 Oct 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/58d8341a-5849-44cd-8ac8-8b020413a31b/https://cerez23.github.io/sigma-rule-library/rules/58d8341a-5849-44cd-8ac8-8b020413a31b/Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm (severity: critical)Sun, 19 Oct 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/9e2e51c5-c699-4794-ba5a-29f5da40ac0c/https://cerez23.github.io/sigma-rule-library/rules/9e2e51c5-c699-4794-ba5a-29f5da40ac0c/Detects commands used by Turla group as reported by ESET in May 2020 (severity: critical)Sun, 19 Oct 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/41d40bff-377a-43e2-8e1b-2e543069e079/https://cerez23.github.io/sigma-rule-library/rules/41d40bff-377a-43e2-8e1b-2e543069e079/Detects WannaCry ransomware activity (severity: critical)Sat, 18 Oct 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/ba479447-721f-42a9-9af2-6dcd517bbdb3/https://cerez23.github.io/sigma-rule-library/rules/ba479447-721f-42a9-9af2-6dcd517bbdb3/Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution. (severity: critical)Thu, 24 Jul 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/4ac47ed3-44c2-4b1f-9d51-bf46e8914126/https://cerez23.github.io/sigma-rule-library/rules/4ac47ed3-44c2-4b1f-9d51-bf46e8914126/Detects indicators of a UAC bypass method by mocking directories (severity: critical)Tue, 17 Jun 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/1de68c67-af5c-4097-9c85-fe5578e09e67/https://cerez23.github.io/sigma-rule-library/rules/1de68c67-af5c-4097-9c85-fe5578e09e67/Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host (severity: critical)Thu, 30 Jan 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/2704ab9e-afe2-4854-a3b1-0c0706d03578/https://cerez23.github.io/sigma-rule-library/rules/2704ab9e-afe2-4854-a3b1-0c0706d03578/Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory (severity: critical)Wed, 22 Jan 2025 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/02e0b2ea-a597-428e-b04a-af6a1a403e5c/https://cerez23.github.io/sigma-rule-library/rules/02e0b2ea-a597-428e-b04a-af6a1a403e5c/Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM (severity: critical)Sun, 01 Dec 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/af8bbce4-f751-46b4-8d91-82a33a736f61/https://cerez23.github.io/sigma-rule-library/rules/af8bbce4-f751-46b4-8d91-82a33a736f61/Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights (severity: critical)Sun, 01 Dec 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/8a7e90c5-fe6e-45dc-889e-057fe4378bd9/https://cerez23.github.io/sigma-rule-library/rules/8a7e90c5-fe6e-45dc-889e-057fe4378bd9/Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120 (severity: critical)Sat, 23 Nov 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/24e3e58a-646b-4b50-adef-02ef935b9fc8/https://cerez23.github.io/sigma-rule-library/rules/24e3e58a-646b-4b50-adef-02ef935b9fc8/Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed (severity: critical)Sat, 23 Nov 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/d0b65ad3-e945-435e-a7a9-438e62dd48e9/https://cerez23.github.io/sigma-rule-library/rules/d0b65ad3-e945-435e-a7a9-438e62dd48e9/Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp (severity: critical)Sat, 23 Nov 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/bb09dd3e-2b78-4819-8e35-a7c1b874e449/https://cerez23.github.io/sigma-rule-library/rules/bb09dd3e-2b78-4819-8e35-a7c1b874e449/Detects the presence and execution of Inveigh via dropped artefacts (severity: critical)Thu, 27 Jun 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/9e099d99-44c2-42b6-a6d8-54c3545cab29/https://cerez23.github.io/sigma-rule-library/rules/9e099d99-44c2-42b6-a6d8-54c3545cab29/Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc. (severity: critical)Thu, 27 Jun 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/847def9e-924d-4e90-b7c4-5f581395a2b4/https://cerez23.github.io/sigma-rule-library/rules/847def9e-924d-4e90-b7c4-5f581395a2b4/Detects a dump file written by QuarksPwDump password dumper (severity: critical)Thu, 27 Jun 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/5118765f-6657-4ddb-a487-d7bd673abbf1/https://cerez23.github.io/sigma-rule-library/rules/5118765f-6657-4ddb-a487-d7bd673abbf1/Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components. (severity: critical)Wed, 20 Mar 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/7215374a-de4f-4b33-8ba5-70804c9251d3/https://cerez23.github.io/sigma-rule-library/rules/7215374a-de4f-4b33-8ba5-70804c9251d3/Detects unauthorized access attempts to a resource. (severity: critical)Sun, 25 Feb 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/34d81081-03c9-4a7f-91c9-5e46af625cde/https://cerez23.github.io/sigma-rule-library/rules/34d81081-03c9-4a7f-91c9-5e46af625cde/Detects when full data export is attempted an unauthorized user. (severity: critical)Sun, 25 Feb 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/4c198a60-7d05-4daf-8bf7-4136fb6f5c62/https://cerez23.github.io/sigma-rule-library/rules/4c198a60-7d05-4daf-8bf7-4136fb6f5c62/This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory. (severity: critical)Tue, 20 Feb 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/d27eabad-9068-401a-b0d6-9eac744d6e67/https://cerez23.github.io/sigma-rule-library/rules/d27eabad-9068-401a-b0d6-9eac744d6e67/Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709. (severity: critical)Tue, 20 Feb 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/304810ed-8853-437f-9e36-c4975c3dfd7e/https://cerez23.github.io/sigma-rule-library/rules/304810ed-8853-437f-9e36-c4975c3dfd7e/Detects Baby Shark C2 Framework default communication patterns (severity: critical)Thu, 15 Feb 2024 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/3b8e5084-4de9-449a-a40d-0e11014f2e2d/https://cerez23.github.io/sigma-rule-library/rules/3b8e5084-4de9-449a-a40d-0e11014f2e2d/Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability (severity: critical)Tue, 24 Oct 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/6fe1719e-ecdf-4caf-bffe-4f501cb0a561/https://cerez23.github.io/sigma-rule-library/rules/6fe1719e-ecdf-4caf-bffe-4f501cb0a561/Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 . (severity: critical)Mon, 23 Oct 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/4ac5fc44-a601-4c06-955b-309df8c4e9d4/https://cerez23.github.io/sigma-rule-library/rules/4ac5fc44-a601-4c06-955b-309df8c4e9d4/Detects registry keys created in OceanLotus (also known as APT32) attacks (severity: critical)Thu, 28 Sep 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/70d43542-cd2d-483c-8f30-f16b436fd7db/https://cerez23.github.io/sigma-rule-library/rules/70d43542-cd2d-483c-8f30-f16b436fd7db/Detects registry key used by Leviathan APT in Malaysian focused campaign (severity: critical)Tue, 19 Sep 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/32b5db62-cb5f-4266-9639-0fa48376ac00/https://cerez23.github.io/sigma-rule-library/rules/32b5db62-cb5f-4266-9639-0fa48376ac00/Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum (severity: critical)Thu, 17 Aug 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/961d0ba2-3eea-4303-a930-2cf78bbfcc5e/https://cerez23.github.io/sigma-rule-library/rules/961d0ba2-3eea-4303-a930-2cf78bbfcc5e/Detects well-known credential dumping tools execution via specific named pipe creation (severity: critical)Mon, 07 Aug 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/1f7025a6-e747-4130-aac4-961eb47015f1/https://cerez23.github.io/sigma-rule-library/rules/1f7025a6-e747-4130-aac4-961eb47015f1/Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege. (severity: critical)Mon, 07 Aug 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/0adc67e0-a68f-4ffd-9c43-28905aad5d6a/https://cerez23.github.io/sigma-rule-library/rules/0adc67e0-a68f-4ffd-9c43-28905aad5d6a/Detects creation of default named pipes used by the Koh tool (severity: critical)Mon, 07 Aug 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/fe3ac066-98bb-432a-b1e7-a5229cb39d4a/https://cerez23.github.io/sigma-rule-library/rules/fe3ac066-98bb-432a-b1e7-a5229cb39d4a/Detects the creation of a named pipe seen used by known APTs or malware. (severity: critical)Mon, 07 Aug 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/0066d244-c277-4c3e-88ec-9e7b777cc8bc/https://cerez23.github.io/sigma-rule-library/rules/0066d244-c277-4c3e-88ec-9e7b777cc8bc/Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884 (severity: critical)Wed, 12 Jul 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/f6a711f3-d032-4f9e-890b-bbe776236c84/https://cerez23.github.io/sigma-rule-library/rules/f6a711f3-d032-4f9e-890b-bbe776236c84/Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor (severity: critical)Fri, 16 Jun 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/ba6b9e43-1d45-4d3c-a504-1043a64c8469/https://cerez23.github.io/sigma-rule-library/rules/ba6b9e43-1d45-4d3c-a504-1043a64c8469/Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527 (severity: critical)Mon, 12 Jun 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/339ed3d6-5490-46d0-96a7-8abe33078f58/https://cerez23.github.io/sigma-rule-library/rules/339ed3d6-5490-46d0-96a7-8abe33078f58/Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity. (severity: critical)Tue, 30 May 2023 00:00:00 GMThttps://cerez23.github.io/sigma-rule-library/rules/bfd34392-c591-4009-b938-9fd985a28b85/https://cerez23.github.io/sigma-rule-library/rules/bfd34392-c591-4009-b938-9fd985a28b85/Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity. (severity: critical)Wed, 24 May 2023 00:00:00 GMT