Sigma detection rules, expert-reviewed

Suspicious BadIIS Native Module Registration via cmd Copy

This rule detects cmd.exe copying an architecture-suffixed 32.dll or 64.dll module with forced overwrite, matching the BadIIS deployment that registers its malicious native IIS module by copying the payload DLL into place. Silent overwrite of a bitness-named module through cmd is part of installing the server-side backdoor. This behavior indicates BadIIS module installation on an IIS host.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Suspicious CloudZ RAT Payload Download via curl to ProgramData

This rule detects curl saving a remote file into the ProgramData Microsoft WindowsDoc directory, matching the CloudZ RAT staging chain that writes update.txt into a fabricated WindowsDoc folder. Downloading a payload directly into a Microsoft-themed ProgramData path masquerades attacker tooling as system content. This ingress behavior indicates active payload retrieval.

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

This rule detects the regasm.exe LOLBin executing against content staged under ProgramData, matching the CloudZ RAT which abuses regasm to load a dropped .NET assembly outside developer workflows. Legitimate use of regasm operates on assemblies in build or install directories, not ProgramData staging folders. Execution from this location signals proxied malicious code loading.

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

This rule detects a scheduled task created to run onstart as SYSTEM that launches regasm.exe, matching the CloudZ RAT which registers a boot-time task to execute its .NET loader through the regasm LOLBin. Chaining an onstart SYSTEM task to a trusted Microsoft signed binary gives the implant privileged persistence while evading application controls. This combination is a strong indicator of CloudZ deployment.

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

This rule detects execution of a binary named DownloadedOneDriveDocument.exe, matching the n8n webhook CAPTCHA campaign that delivers a modified Datto RMM agent under a document-themed filename. Naming a remote management installer to look like a downloaded OneDrive document tricks users into running the RMM foothold. Execution of this file indicates delivery of the abused remote access tooling.

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

This rule detects execution of the ThrottleStop utility which ships a vulnerable driver abused to disable endpoint protection. Ransomware operators in Japanese incidents load ThrottleStop as part of their EDR-killer tooling before encryption. Bring-your-own-vulnerable-driver tools let an actor terminate security software from kernel space.

Suspicious Local Account Creation via Net User in Pre-Ransomware Phase

This rule detects creation of a new account using net user with the add flag. Ransomware actors targeting Japanese organizations create rogue accounts such as Attacker1 for persistence before deploying encryption. New account creation during an intrusion often precedes hands-on ransomware staging.

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

This rule detects creation of a scheduled task that runs at system startup, matching the WSPrint persistence used by UAT-9244. The actor registers a task to relaunch a side-loaded implant on boot under a printing service name. Startup scheduled tasks provide durable persistence across reboots.

Suspicious Script Download via Curl and PowerShell by Dohdoor

This rule detects the curl utility downloading a batch or command script over HTTP. The Dohdoor campaign uses PowerShell wrapped curl requests to stage follow-on .bat and .cmd payloads. Fetching executable scripts through curl is characteristic of malware staging.

Malicious Native IIS Module Installation via Appcmd by UAT-8099

This rule detects registration of a native IIS module using appcmd. UAT-8099 installs malicious BadIIS modules to intercept web traffic on compromised servers. Rogue IIS modules give an actor passive persistence and traffic manipulation inside the web server process.

Suspicious Hidden Local Account Creation via Net User by UAT-8099

This rule detects creation of a local account whose name ends with a dollar sign which hides it from standard enumeration. UAT-8099 creates hidden accounts such as admin and mysql with a trailing dollar sign for stealthy persistence. Hidden accounts let an actor retain access while evading routine account audits.

Suspicious Service Principal Name Enumeration via Setspn by UAT-8837

This rule detects use of setspn to query service principal names across the domain. UAT-8837 enumerates SPNs as a precursor to Kerberoasting service accounts. Harvesting SPNs allows an actor to request and crack service ticket hashes offline.

Malicious SOCKS Proxy Tunnel via Earthworm Rssocks by UAT-8837

This rule detects execution of the Earthworm tunneling tool in rssocks reverse SOCKS mode connecting outbound. UAT-8837 uses Earthworm renamed as v.ico or verr.ico to tunnel traffic into victim networks. Reverse SOCKS proxies give an actor interactive access to internal systems while evading perimeter controls.

Malicious Group Policy Preferences Credential Hunting via Findstr by UAT-8837

This rule detects use of findstr to recursively search policy files for the cpassword attribute. UAT-8837 harvests Group Policy Preferences passwords which can be decrypted with a publicly known AES key. Locating cpassword values yields reusable domain credentials for privilege escalation and lateral movement.