Sigma detection rules, expert-reviewed

Suspicious Tycoon 2FA Phishing Script Retrieval

This rule detects retrieval of the randomly numbered myscr JavaScript file served by the Tycoon 2FA phishing kit. The kit loads a script matching the /myscr######.js pattern to render its credential-harvesting page, so this URI shape signals an AiTM phishing landing.

Malicious DDoSia Client C2 Check-In via Fixed User-Agent

This rule detects the NoName057(16) DDoSia client registering with its C2 by POSTing to a /client/login endpoint using a hardcoded legacy Gecko User-Agent. The combination of that outdated User-Agent string and the login path identifies the DDoS bot fetching its target list.

Suspicious HijackLoader PNG Payload Retrieval via ClearFake

This rule detects retrieval of a HijackLoader stage disguised as a PNG image from the ClearFake osmesis distribution path. The loader downloads its encoded payload from a URI under /osmesis/ ending in .png, blending malware delivery into image traffic.

Suspicious wscript Execution Forcing VBScript Engine in Batch Mode

This rule detects wscript.exe executing a script with an explicit vbscript engine selection and batch mode flag. Gamaredon GammaSteel launches its VBScript loader this way to suppress errors and dialogs during execution. Explicitly forcing the engine and silencing output is unusual for benign scripts and points to automated malware execution.

Suspicious mshta Execution of Inline JavaScript

This rule detects mshta.exe running an inline javascript command line. Gamaredon delivers HTA and LNK files that invoke mshta with javascript to launch the next stage of GammaPhish. Inline scripting through mshta is a well known living off the land execution and evasion technique.

Suspicious Hidden PowerShell Web Download via ClickFix Tactic

This rule detects PowerShell launched with a hidden window and no profile that immediately downloads and starts a remote payload. IClickFix and related WordPress driven ClickFix campaigns trick users into pasting this command from a fake verification prompt. The combination of a hidden window a bypassed profile and an inline web download reflects unattended payload retrieval rather than normal administration.

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

This rule detects a Linux shell one-liner that pipes curl output through xxd and base64 into eval to decode and execute an in-memory payload. This behavior is used by TransparentTribe to deploy the DeskRAT implant against Indian military targets. Chaining hex and base64 decoding into eval lets the attacker run downloaded code without touching disk which frustrates static detection.

Malicious DLL Registration via regsvr32 Loading prnfldr (via process_creation)

This rule detects regsvr32.exe registering the prnfldr.dll payload using the silent install flags. In Operation Phantom Net Voxel APT28 executes its loader DLL through regsvr32 with the /n /i options to run code while bypassing application controls. Regsvr32 loading this named DLL is characteristic of the campaign proxy execution.

Malicious Cryptocurrency Miner Execution via XMRig and c3pool (via process_creation)

This rule detects execution of the XMRig cryptocurrency miner or connections to the c3pool mining pool. The Mimo campaign deploys XMRig against compromised Craft CMS servers to mine Monero using victim resources. Miner binaries and pool references indicate resource hijacking for financial gain.

Malicious Download Piped to Shell via curl or wget (via process_creation)

This rule detects a remote script being downloaded with curl or wget and piped directly into a shell for execution. The Mimo campaign exploiting Craft CMS fetches its loader script and pipes it to bash to run the payload without touching disk. Downloading and immediately executing a remote script through a pipe is a classic Linux compromise pattern.

Suspicious File Hiding via attrib Hidden and System Attributes (via process_creation)

This rule detects use of attrib.exe to set both the hidden and system attributes on a file. The multi-stage infection chains hide their dropped startup scripts and payloads from casual inspection using this technique. Applying the hidden and system flags together is a common defense evasion move to conceal malicious artifacts.

Suspicious Command Interpreter Spawned by mshta (via process_creation)

This rule detects cmd or PowerShell being launched as a child of mshta.exe. The multi-stage infection chains analyzed by Sekoia deliver an LNK that opens an HTA which then spawns a command interpreter to continue the chain. A command interpreter descending from mshta indicates HTA-based staged execution rather than normal application behavior.

Suspicious Data Exfiltration to Azure Blob Storage via AzCopy (via process_creation)

This rule detects AzCopy copying local data to an Azure blob storage endpoint. The Interlock ransomware operators abuse AzCopy to exfiltrate stolen files to attacker-controlled cloud storage before encryption. AzCopy transferring data to blob core windows net from an unexpected host indicates exfiltration to cloud storage.

Suspicious Node.js Execution of nvidia.js Script via cmd (via process_creation)

This rule detects the Node.js runtime executing a script named nvidia.js. The Lazarus ClickFake Interview campaign runs its JavaScript backdoor through node while masquerading as GPU driver tooling. Node executing this specific script indicates malicious cross-platform payload execution.

Suspicious File Download via busybox ftpget (via process_creation)

This rule detects use of the busybox ftpget command to retrieve a remote archive on embedded and IoT devices. The PolarEdge ORB network uses busybox ftpget to fetch its payload archive after exploiting CVE-2023-20118. Downloading tooling over FTP with busybox on network appliances is characteristic of botnet staging.