New Rules

• new: Attempts of Kerberos Coercion Via DNS SPN Spoofing
• new: BITS Client BitsProxy DLL Loaded By Uncommon Process
• new: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
• new: DNS Query To Common Malware Hosting and Shortener Services
• new: DNS Query To Katz Stealer Domains
• new: DNS Query To Katz Stealer Domains - Network
• new: Disable ASLR Via Personality Syscall - Linux
• new: FileFix - Command Evidence in TypedPaths from Browser File Upload Abuse
• new: FileFix - Suspicious Child Process from Browser File Upload Abuse
• new: HKTL - SharpSuccessor Privilege Escalation Tool Execution
• new: HackTool - Doppelanger LSASS Dumper Execution
• new: HackTool - HollowReaper Execution
• new: HackTool - Impacket File Indicators
• new: Katz Stealer DLL Loaded
• new: Katz Stealer Suspicious User-Agent
• new: MSSQL Destructive Query
• new: Obfuscated PowerShell MSI Install via WindowsInstaller COM
• new: Potential AS-REP Roasting via Kerberos TGT Requests
• new: Potential Abuse of Linux Magic System Request Key
• new: Potential Exploitation of RCE Vulnerability CVE-2025-33053
• new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load
• new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
• new: Potential Java WebShell Upload in SAP NetViewer Server
• new: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
• new: Potential Notepad++ CVE-2025-49144 Exploitation
• new: Potential SAP NetViewer Webshell Command Execution
• new: PowerShell MSI Install via WindowsInstaller COM From Remote Location
• new: Proxy Execution via Vshadow - detect invocation of vshadow.exe with -exec to spot hidden malware execution
• new: RegAsm.EXE Execution Without CommandLine Flags or Files
• new: Registry Export of Third-Party Credentials
• new: Remote Access Tool - Potential MeshAgent Usage - MacOS
• new: Remote Access Tool - Potential MeshAgent Usage - Windows
• new: Remote Access Tool - Suspicious MeshAgent Usage - MacOS
• new: Remote Access Tool - Suspicious MeshAgent Usage - Windows
• new: Special File Creation via Mknod Syscall
• new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
• new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
• new: Suspicious Deno File Written from Remote Source
• new: Suspicious Download and Execute Pattern via Curl/Wget
• new: Suspicious File Access to Browser Credential Storage
• new: System Info Discovery via Sysinfo Syscall
• new: System Information Discovery via Registry Queries
• new: Trusted Path Bypass via Windows Directory Spoofing

Updated Rules

• update: Access of Sudoers File Content - add more tools
• update: AspNetCompiler Execution - Add ARM version of the \Microsoft.NET path
• update: Audio Capture - use syscall name instead of id
• update: Cisco Modify Configuration - add "ntp server" keyword
• update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - use syscall name instead of id
• update: Commands to Clear or Remove the Syslog - detect journald vacuuming
• update: Disable ASLR Via Personality Syscall - Linux - use syscall name instead of id
• update: Disable Internal Tools or Feature in Registry - More registry modifications associated with feature change of windows internal tools added
• update: Enumeration for 3rd Party Creds From CLI - Updated the condition to update FP
• update: File Decoded From Base64/Hex Via Certutil.EXE - Increase level to high
• update: FileFix - Suspicious Child Process from Browser File Upload Abuse - add cmd.exe child process
• update: HackTool - LaZagne Execution: filter added to reduce FP and added more coverage through imphash
• update: Local Groups Discovery - Linux - add text output tools
• update: MSHTA Execution with Suspicious File Extensions - title changed and more susp extension added
• update: Malicious PowerShell Commandlets - PoshModule - Add BadSuccessor Exploit
• update: Malicious PowerShell Commandlets - PoshModule - add Invoke-PowerDPAPI
• update: Malicious PowerShell Commandlets - ProcessCreation - add Invoke-PowerDPAPI
• update: Malicious PowerShell Commandlets - ScriptBlock - add Invoke-PowerDPAPI
• update: Malicious PowerShell Scripts - FileCreation - Add BadSuccessor Exploit
• update: Malicious PowerShell Scripts - FileCreation - add Invoke-PowerDPAPI
• update: Malicious PowerShell Scripts - PoshModule - Add BadSuccessor Exploit
• update: Malicious PowerShell Scripts - PoshModule - add Invoke-PowerDPAPI
• update: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image - add Unicode space character
• update: Potential PowerShell Obfuscation Via WCHAR/CHAR - Add CHAR variation
• update: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler - Add ARM version of the \Microsoft.NET path
• update: Program Executed Using Proxy/Local Command Via SSH.EXE - add Imphash and OriginalFileName
• update: Remote Thread Created In Shell Application - move to threat-hunting folder as it causes too much noise
• update: Suspicious Double Extension File Execution: add more suspicious extension combination
• update: Suspicious Double Extension Files: add more suspicious extension combination
• update: Suspicious SignIns From A Non Registered Device - add null value in addition to empty string
• update: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE - Increase coverage by adding new values that allow for Windows Defender to be disabled such as DisableCloudProtection and DisableSecurityCenter
• update: System Owner or User Discovery - Linux - add uname
• update: TrustedPath UAC Bypass Pattern - update Image value
• update: Webshell Remote Command Execution - add execveat and match on euid instead of key

Fixed Rules

• fix: ADS Zone.Identifier Deleted By Uncommon Application - filter msedge
• fix: AddinUtil.EXE Execution From Uncommon Directory - Add filter for Windows Microsoft.NET ARM path
• fix: Amsi.DLL Load By Uncommon Process - Add filter for Windows Microsoft.NET ARM path
• fix: Common Autorun Keys Modification - add 64 bits Program Files directory in filter
• fix: Creation of an Executable by an Executable - Add filter for Windows Microsoft.NET ARM path
• fix: CurrentVersion Autorun Keys Modification - add 64 bits Program Files directory in filter
• fix: CurrentVersion NT Autorun Keys Modification - add filter for RuntimeBroker.exe
• fix: Hidden Files and Directories - reduce FP matching with regex pattern
• fix: MSSQL Server Failed Logon From External Network - filter for local_machine without IP
• fix: Modification of IE Registry Settings - add filter for RuntimeBroker.exe
• fix: Potential AS-REP Roasting via Kerberos TGT Requests - use the correct PreAuthType selection field name
• fix: Potential Active Directory Reconnaissance/Enumeration Via LDAP - commenting out troublesome LDAP query parameter
• fix: Potential Binary Or Script Dropper Via PowerShell - add filters for legitimate binary dropped by PowerShell
• fix: Potential DLL Sideloading Of MsCorSvc.DLL - Add filter for Windows Microsoft.NET ARM path
• fix: Potential System DLL Sideloading From Non System Locations - Add filter for "C:\Windows\SyChpe32"
• fix: PowerShell Core DLL Loaded By Non PowerShell Process - Add filter for Windows Microsoft.NET ARM path
• fix: Rare Remote Thread Creation By Uncommon Source Image - add new filters to reduce noise
• fix: Remote Thread Created In Shell Application - modify the logic to filter out legit processes creating remote thread in shell apps
• fix: Remote Thread Creation By Uncommon Source Image - add new filters to reduce noise
• fix: Remote Thread Creation In Uncommon Target Image - add FP filters for notepad and sethc
• fix: Scheduled TaskCache Change by Uncommon Program - add filter for RuntimeBroker.exe
• fix: Suspicious Sysmon as Execution Parent - add filter for Sysmon binary running from temp dir
• fix: Suspicious Userinit Child Process - filter null Image
• fix: Suspicious WSMAN Provider Image Loads - Add filter for Windows Microsoft.NET ARM path
• fix: Uncommon AppX Package Locations - add a new filter to reduce noise
• fix: Use Short Name Path in Command Line - add filter for aurora
• fix: WMI Module Loaded By Uncommon Process - Add filter for Windows Microsoft.NET ARM path

Acknowledgement

Thanks to @0xFustang, @ajpc500, @ariel-anieli, @CheraghiMilad, @dan21san, @david-syk, @egycondor, @EzLucky, @frack113, @gregorywychowaniec-zt, @GrepItAll, @hashdr1ft, @joshnck, @JrOrOneEquals1, @kivi280, @MalGamy12, @nasbench, @nikstuckenbrock, @norbert791, @phantinuss, @swachchhanda000, @unicornofhunt, @vx3r, @wieso-itzi, @X-Junior, @xlazarg for their contribution to this release

Which Sigma rule package should I use?

A detailed explanation can be found in the Releases.md file. If you are new to Sigma, we recommend starting with the "Core" ruleset.

The latest release package on GitHub can always be found here.