Sigma Rule Library — recently updated rules

Linux Webshell Indicators

Wed, 19 Aug 2026 00:00:00 GMT

Detects suspicious sub processes of web server processes (severity: high)

PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy

Wed, 19 Aug 2026 00:00:00 GMT

Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local. (severity: low)

New User Account Creation Attempt Via ADSI

Thu, 13 Aug 2026 00:00:00 GMT

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser". (severity: medium)

New User Account Creation Attempt Via ADSI in CommandLine

Thu, 13 Aug 2026 00:00:00 GMT

Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser". (severity: medium)

Potentially Suspicious Mofcomp Execution

Thu, 06 Aug 2026 00:00:00 GMT

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts (severity: high)

Uncommon New Firewall Rule Added In Windows Firewall Exception List

Thu, 06 Aug 2026 00:00:00 GMT

Detects when a rule has been added to the Windows Firewall exception list (severity: medium)

Active Directory Replication from Non Machine Account - DcSync Indicator

Thu, 30 Jul 2026 00:00:00 GMT

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. (severity: medium)

ADCS - Certighost Ghost Machine Account Creation

Thu, 30 Jul 2026 00:00:00 GMT

Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix. (severity: high)

Suspicious Machine Account Replication - DcSync Indicator

Thu, 30 Jul 2026 00:00:00 GMT

Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller. Under normal operation, only Domain Controllers initiate replication requests carrying the DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account credentials — for example by abusing certificate-based authentication (PKINIT) to impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost), where a temporary machine account is created to request a DC certificate and then used to perform DCSync — they can dump all domain credential material including the krbtgt hash. (severity: medium)

Certificate Services Outbound SMB or LDAP Connection

Wed, 29 Jul 2026 00:00:00 GMT

Detects the Windows Certificate Services process (certsrv.exe) initiating an outbound network connection on port 445 (SMB) or 389 (LDAP) to a non-DC host. This behaviour is inherently suspicious: under normal operation the CA resolves subject identities via local RPC against the domain and never initiates outbound SMB or LDAP connections to arbitrary hosts. Any such connection indicates the CA is being coerced into performing a remote identity lookup against an attacker-controlled host. The most direct known trigger is the CA chase fallback (EDITF_ENABLECHASECLIENTDC) where a requester-supplied 'cdc' attribute causes the CA to open SMB and LDAP to a specified address. CVE-2026-54121 (Certighost) exploits this path to redirect the CA to rogue LSA and LDAP services that return a DC's identity, resulting in a forged DC certificate. This rule is not limited to Certighost — any future vulnerability or misconfiguration that causes certsrv.exe to make outbound SMB or LDAP connections is covered. (severity: high)

DC Machine Account Network Logon from Non-DC Source IP

Wed, 29 Jul 2026 00:00:00 GMT

Detects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without requesting a TGT - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from a non-DC host - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a Kerberos ticket and is authenticating from a non-DC host - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost): attacker obtained a DC certificate via ADCS CDC-chase abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync (severity: critical)

DC Machine Account TGS Request from Non-DC Source IP

Wed, 29 Jul 2026 00:00:00 GMT

Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller machine account's service (e.g. DRSUAPI) originating from an IP address that is not a known Domain Controller. Service tickets for DC machine accounts should only be requested by other DCs during legitimate replication operations. An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT) targeting a DC machine account's service from a workstation IP indicates preparation for DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and bypass this event), this rule catches attacks that go through the KDC legitimately. This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with all known DC machine account names and DC IP addresses respectively. (severity: high)

DC Machine Account TGT Request from Non-DC Source IP

Wed, 29 Jul 2026 00:00:00 GMT

Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account originating from an IP address that is not a known Domain Controller. DC machine accounts should only request TGTs from their own IP. Any TGT request for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a forged certificate from their workstation - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a Kerberos TGT - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos (severity: high)

Access To Windows DPAPI Master Keys By Uncommon Applications

Tue, 28 Jul 2026 00:00:00 GMT

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function (severity: medium)

Credential Manager Access By Uncommon Applications

Tue, 28 Jul 2026 00:00:00 GMT

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function (severity: medium)

Files With System Process Name In Unsuspected Locations

Tue, 28 Jul 2026 00:00:00 GMT

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). It is highly recommended to perform an initial baseline before using this rule in production. (severity: medium)

Load Of RstrtMgr.DLL By An Uncommon Process

Tue, 28 Jul 2026 00:00:00 GMT

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes. (severity: low)

Msiexec Quiet Installation

Tue, 28 Jul 2026 00:00:00 GMT

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi) (severity: medium)

PowerShell Core DLL Loaded By Non PowerShell Process

Tue, 28 Jul 2026 00:00:00 GMT

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension. (severity: medium)

PSScriptPolicyTest Creation By Uncommon Process

Tue, 28 Jul 2026 00:00:00 GMT

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. (severity: medium)

Suspicious WSMAN Provider Image Loads

Tue, 28 Jul 2026 00:00:00 GMT

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. (severity: medium)

System File Execution Location Anomaly

Tue, 28 Jul 2026 00:00:00 GMT

Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. (severity: high)

ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)

Mon, 27 Jul 2026 00:00:00 GMT

Detects Active Directory Certificate Services (ADCS) certificate requests that include the 'cdc' (Client DC) request attribute pointing to a domain or IP that is not a known Domain Controller. 'cdc' is an optional MS-WCCE enrollment attribute designed for cross-domain/cross-forest scenarios where a client in a child domain tells the CA which DC to contact for identity lookups when the CA cannot reach that domain directly. Legitimate values are DC hostnames or IPs that resolve to a real Domain Controller computer object in AD with the SERVER_TRUST_ACCOUNT (0x2000) userAccountControl bit set. In an attack, the attacker sets cdc to a domain or IP they control so the CA connects to their rogue SMB and LDAP services instead of a real DC. The rogue server returns a forged DC identity which the pre-patch CA accepts without validation. A malicious event looks like: Requester: DOMAIN\GHOST$ Attributes: cdc: rmd: SubjectAlternativeName: DNS Name= CVE-2026-54121 (Certighost) is the known exploit for this path. The July 2026 patch added _ValidateChaseTargetIsDC which rejects cdc values that do not resolve to a legitimate DC object in Active Directory before following the chase. (severity: high)

ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)

Mon, 27 Jul 2026 00:00:00 GMT

Detects successful issuance of an ADCS certificate where the request attributes include 'cdc' (Client DC) or 'rmd' (Remote Domain) pointing to a non-DC domain or IP, confirming the CA's chase fallback path was taken against an attacker-controlled target. 'cdc' directs the CA to an address for identity lookup; 'rmd' specifies the principal to look up there. In an attack (CVE-2026-54121, Certighost), cdc points to a rogue host that returns a forged DC identity. A successfully issued certificate at this stage means the attacker has obtained a cert carrying a Domain Controller's SID and DNS identity, enabling PKINIT authentication as that DC followed by DCSync replication. (severity: high)

Network Communication With Crypto Mining Pool

Fri, 24 Jul 2026 00:00:00 GMT

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. (severity: high)

DNS Query to External Service Interaction Domains

Thu, 23 Jul 2026 00:00:00 GMT

Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain. A detection indicates that a host on your network resolved one of these domains, which may mean: (1) an attacker is actively probing or exploiting a vulnerable service and using the callback to confirm code execution or data exfiltration, (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets. Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session), and any concurrent outbound connections or process activity to determine intent. (severity: high)

Potentially Suspicious Explicit Credential Local Logon

Thu, 23 Jul 2026 00:00:00 GMT

Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account. (severity: medium)

Potentially Suspicious Image Load of Offreg.dll

Thu, 23 Jul 2026 00:00:00 GMT

Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. (severity: medium)

Registry Hive File Staged Outside Standard User Profile Path

Thu, 23 Jul 2026 00:00:00 GMT

Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user's profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. (severity: high)

Suspicious Cross-User Process Spawn

Thu, 23 Jul 2026 00:00:00 GMT

Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation. (severity: medium)

Sysmon Configuration Error

Thu, 23 Jul 2026 00:00:00 GMT

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages (severity: high)

Rundll32 UNC Path Execution

Mon, 20 Jul 2026 00:00:00 GMT

Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh. (severity: high)

WordPress Wp2shell Exploitation Tool User-Agent

Sun, 19 Jul 2026 00:00:00 GMT

Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation. (severity: high)

WordPress Wp2shell REST Batch Endpoint Exploitation

Sun, 19 Jul 2026 00:00:00 GMT

Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target. (severity: medium)

WordPress Wp2shell Webshell Plugin Access

Sun, 19 Jul 2026 00:00:00 GMT

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence. (severity: critical)

Webshell Detection With Command Line Keywords

Tue, 14 Jul 2026 00:00:00 GMT

Detects certain command line parameters often used during reconnaissance activity via web shells (severity: high)

AWS Bedrock Guardrail Deleted

Fri, 10 Jul 2026 00:00:00 GMT

Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses. (severity: medium)

AWS Bedrock Guardrail Updated

Fri, 10 Jul 2026 00:00:00 GMT

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. (severity: medium)

Potential System DLL Sideloading From Non System Locations

Fri, 10 Jul 2026 00:00:00 GMT

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). (severity: high)

Local System Accounts Discovery - MacOs

Tue, 07 Jul 2026 00:00:00 GMT

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation. (severity: low)

Execution Of Non-Existing File

Sun, 05 Jul 2026 00:00:00 GMT

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques. (severity: high)

Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog

Wed, 01 Jul 2026 00:00:00 GMT

Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated when the WMI operation encounters an error (e.g. access denied, provider failure). It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues. Successful clearing operations will NOT produce this event; for those, correlate with Security event 1102 or System event 104. (severity: medium)

Windows Defender Disabled Via SystemSettingsAdminFlows.EXE

Wed, 01 Jul 2026 00:00:00 GMT

Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender. SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks. However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns. (severity: high)

Amsi.DLL Load By Uncommon Process

Mon, 29 Jun 2026 00:00:00 GMT

Detects loading of Amsi.dll by uncommon processes (severity: low)

Antivirus - Relevant File Paths Alerts Signature

Mon, 29 Jun 2026 00:00:00 GMT

Detects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: high)

Antivirus - Web Shell Detection Signature

Mon, 29 Jun 2026 00:00:00 GMT

Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. (severity: high)

CredUI.DLL Loaded By Uncommon Process

Mon, 29 Jun 2026 00:00:00 GMT

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW". (severity: medium)

HackTool - SysmonEnte Execution

Mon, 29 Jun 2026 00:00:00 GMT

Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon (severity: high)

Permission Check Via Accesschk.EXE

Mon, 29 Jun 2026 00:00:00 GMT

Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges (severity: medium)

Potential Credential Dumping Activity Via LSASS

Mon, 29 Jun 2026 00:00:00 GMT

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. (severity: medium)