Sigma detection rules, expert-reviewed

Suspicious Remote Admin Share Execution via Conhost

This rule detects the console host process conhost.exe launched with arguments referencing a remote administrative admin share which Interlock ransomware operators abuse for lateral movement and remote command execution. Conhost invoked with a remote drive share path is anomalous because it is normally spawned locally by console applications without any network share argument.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.

Suspicious File Download Via Bitsadmin Transfer

This rule detects bitsadmin.exe invoked with a transfer job pointing to a remote URL. TA866 abused bitsadmin alongside certutil to pull additional payloads onto compromised hosts. Using the BITS admin tool to download files is a living-off-the-land ingress and BITS-jobs technique that evades naive download monitoring.

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

This rule detects a command line that changes the console code page with chcp and then runs nltest for domain trust enumeration. TA866 Asylum Ambuscade used cmd.exe with chcp 65001 chained to nltest DOMAIN_TRUSTS during host reconnaissance. A UTF-8 code-page switch immediately preceding domain trust enumeration is a scripted discovery pattern tied to this actor.

Malicious Shadow Copy Deletion Via WMI

This rule detects PowerShell querying Win32_Shadowcopy and piping the result to Remove-WmiObject to delete volume shadow copies. Akira ransomware used Get-WmiObject Win32_Shadowcopy piped to Remove-WmiObject to destroy shadow copies before encryption. Deleting shadow copies is an inhibit-recovery action that prevents victims from restoring files without paying the ransom.

Suspicious Domain Trust Discovery Via Nltest

This rule detects nltest.exe enumerating domain trust relationships. UAT-5647 ran nltest domain_trusts to map Active Directory trusts during reconnaissance in the RomCom intrusions. Nltest domain trust enumeration is a common domain-discovery action attackers use to plan lateral movement across trusted domains.

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

This rule detects command lines containing the Mimikatz sekurlsa logonpasswords credential-dumping directive. DragonRank ran rundll32 with the sekurlsa logonpasswords module to harvest credentials from LSASS memory. The sekurlsa logonpasswords string is a distinctive Mimikatz artifact indicating active OS credential theft.

Suspicious Office Application Spawning Script Or Shell Interpreter

This rule detects a Microsoft Office application spawning a command shell or scripting interpreter. MacroPack-generated maldocs used VBA to launch child interpreters that injected and executed offensive-tool loaders such as Havoc and Brute Ratel. Office applications spawning cmd powershell wscript or rundll32 is a strong macro-abuse signal for the initial execution stage of an intrusion.

Suspicious Office Application Spawning Mshta With Remote HTA

This rule detects a Microsoft Office application spawning mshta.exe with a remote HTTP or HTTPS URL. Threat actors using MacroPack-built documents launched mshta from Office to fetch remote HTA payloads that loaded Havoc Brute Ratel and PhantomCore. Office spawning mshta to pull a remote HTA is a phishing execution chain that bridges a malicious macro to a fileless second stage.

Suspicious PowerShell Download Of Text-Disguised Payload

This rule detects PowerShell downloading a file with a .txt extension using a web download method. MoonPeak loaders retrieved a calc.txt file that was actually a GZIP-compressed RTF payload staged for later conversion and execution. Serving executable or archive content under an innocuous .txt name is a masquerading trick used to slip payloads past content filters.

Malicious NetSupport RAT Client32 Execution

This rule detects execution of client32.exe the NetSupport Manager remote-control client binary from a user-writable directory. Threat actors repackaged NetSupport Manager as a RAT delivered through fake browser update lures in this campaign. NetSupport client32 running from temp or profile paths rather than an installed program directory indicates abuse for unauthorized remote access.

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

This rule detects wscript.exe or cscript.exe spawning PowerShell with execution-policy bypass and no-profile command execution flags. This chain was observed delivering NetSupport RAT where a JavaScript ActiveXObject WScript.Shell launched PowerShell to fetch the payload. Script hosts invoking hidden bypass PowerShell is a common loader pattern that downloads and runs second-stage malware.

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

This rule detects a scheduled task creation that masquerades as a Microsoft Edge update task while pointing its action at an executable under the temp directory which the SpiceRAT loader uses for persistence. A legitimate-looking update task name paired with a temp path payload is a strong masquerading plus persistence signal.

Suspicious Scheduled Task Created From XML Definition (via process_creation)

This rule detects schtasks creating a task from an external XML definition file which the Cosmic Leopard Windows component uses to establish persistence. Importing a task from an XML blob lets attackers set arbitrary triggers and actions while avoiding inline command inspection.

Suspicious System Profiler Hardware Enumeration (via process_creation)

This rule detects system_profiler querying SPHardwareDataType which the Cosmic Leopard macOS implant uses to fingerprint the host and detect virtual or analysis environments. Hardware enumeration is an early discovery step that informs targeting and sandbox evasion decisions.