Sigma detection rules, expert-reviewed

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

This rule detects PowerShell using the BITS transfer cmdlet to download a DLL payload, matching the WARMCOOKIE backdoor delivery chain initiated from a malicious JavaScript file. The technique leverages the background intelligent transfer service to retrieve the loader while evading some download monitoring. A DLL fetched by Start-BitsTransfer through PowerShell is highly suspicious.

Malicious GHOSTENGINE Scheduled Task Creation Masquerading as Updater via process_creation

This rule detects creation of scheduled tasks using GHOSTENGINE masquerade names such as OneDriveCloudSync DefaultBrowserUpdate and OneDriveCloudBackup that run payloads as SYSTEM. These tasks impersonate legitimate update services to persist the crypto mining operation. The specific task names are strong indicators of this intrusion set.

Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation

This rule detects a masquerading TiWorker.exe process spawning PowerShell to fetch a remotely hosted payload disguised as a PNG image, matching the GHOSTENGINE crypto mining infection chain. The legitimate TiWorker.exe is a Windows Modules Installer worker and does not normally launch PowerShell download activity. This behavior indicates process masquerading for initial payload retrieval.

Suspicious Scheduled Task Updater Creation for Loader Persistence via process_creation

This rule detects creation of a scheduled task named Updater configured to run at user logon via schtasks and re-launch a loader DLL through rundll32, a persistence mechanism used by LATRODECTUS. The task mimics legitimate software while re-executing the implant to survive reboots. The logon trigger combined with rundll32 execution is suspicious.

Suspicious Alternate Data Stream Self-Deletion via process_creation

This rule detects references to the wtfbbq alternate data stream used by the LATRODECTUS loader to self-delete after execution and remove forensic traces. The malware moves itself into this named stream to evade file-based detection and cleanup. The distinctive stream name is a reliable indicator of this loader family.

Malicious UAC Bypass via ICMLuaUtil COM Elevation via process_creation

This rule detects the auto-elevating COM object ICMLuaUtil being invoked through dllhost.exe to bypass User Account Control, a technique used by the REMCOS RAT for silent privilege escalation. The malware leverages the CMSTPLUA elevation moniker to execute commands with administrative rights without prompting the user. This behavior is a reliable indicator of UAC bypass activity.

Suspicious Browser History Dumping via NirSoft Tool via process_creation

This rule detects execution of the NirSoft BrowsingHistoryView utility, which the REMCOS RAT abuses through its DumpBrowserHistoryUsingNirsoft command to collect victim browsing data. Attackers stage this signed third-party tool to harvest history for reconnaissance and credential context. Its appearance outside sanctioned administrative use is suspicious.

Malicious WannaCry Decryptor Launching Tor via process_creation

This rule detects the WannaCry ransom note component WanaDecryptor spawning the bundled tor.exe used for anonymous communication with the operators. This activity supports the ransomware payment and command channel over the Tor network. Its presence confirms a WannaCry infection reaching the ransom stage.

Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation

This rule detects the WannaCry payload tasksche.exe being launched by its dropper service process mssecsvc.exe. This parent-child relationship reflects the core WannaCry infection chain where the network worm component deploys the encryptor. Observing this process lineage indicates an active WannaCry compromise.

Malicious Shadow Copy Deletion and Recovery Inhibition via process_creation

This rule detects the destruction of volume shadow copies and disabling of Windows recovery options, a hallmark of WannaCry and other ransomware families. The activity removes backups via vssadmin and wmic, disables boot recovery via bcdedit, or deletes the backup catalog via wbadmin to prevent victim recovery. This behavior almost always precedes or accompanies file encryption and warrants immediate response.

Suspicious Print Filter Pipeline Host Running Outside System32 via Process Creation

This rule detects the print filter pipeline host binary printfilterpipelinesvc executing from any path other than System32 which reflects a WinSxS directory masquerade used by an in the wild Windows local privilege escalation exploit to run code under a trusted system process name. The legitimate binary only runs from System32 so execution elsewhere signals a masquerade.

Suspicious Execution of Hidden Binary from Private Tmp via Process Creation

This rule detects execution of a dot-prefixed hidden binary from the private tmp directory which the macOS pirate ship campaign uses to run its dropped Khepri payload from a concealed location. Running hidden executables out of a world-writable temporary directory is a strong indicator of malware attempting to evade file visibility.

Suspicious Script Host Spawning PowerShell via Process Creation

This rule detects the Windows script host wscript or cscript launching PowerShell which mirrors the PIKABOT delivery chain where an obfuscated JavaScript file spawns PowerShell to download the loader. This parent child relationship is a frequent indicator of scripted phishing payloads executing.

Suspicious PIKABOT PowerShell Download to Public Directory via Process Creation

This rule detects PowerShell using Invoke-WebRequest to download an executable into the public users directory which is the delivery step of the PIKABOT infection chain after an obfuscated script launches PowerShell. Fetching a payload directly into a world-writable path is a common malware staging behavior.

Malicious Credential Hive Dump via Reg Save

This rule detects use of reg save to export the SAM registry hive which the REF0657 intrusion used to steal local account password hashes for offline cracking. Saving the SAM hive is a credential access action with no benign use case in normal administration.