Sigma detection rules, expert-reviewed

Malicious FIN7 AvNeutralizer EDR Killer Execution via Masqueraded Binary (via process_creation)

This rule detects execution of the FIN7 userland components that tamper with and disable endpoint security products. The binaries follow a consistent naming convention that references specific security vendors. Their execution indicates an attempt to blind defensive tooling before deploying ransomware or implants.

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

This rule detects the obfuscated PowerShell command line used by FIN7 to launch the Powertrash loader and stage its implants. The activity combines an execution policy bypass, a hidden window, and a non-interactive session, typically alongside an encoded payload. This flag combination is uncommon in benign automation.

Suspicious Kimsuky Remote HTA Payload Execution via mshta (via process_creation)

This rule detects mshta retrieving and executing a remote HTA payload over HTTP, the delivery step Kimsuky used to fetch staged scripts from its reconnaissance infrastructure. Passing a remote URL and an hta resource to mshta indicates a download-and-execute proxy technique. Legitimate remote HTA execution is rare in most enterprises.

Malicious HUI Loader DLL Side-Loading via McAfee mfeann.exe (via image_load)

This rule detects HUI Loader side-loading, where the legitimate signed McAfee binary mfeann.exe loads an attacker-supplied LockDown.dll. This pairing was used against the Asian gambling sector to run encrypted payloads under a trusted process. The DLL name loaded by this specific host executable is a strong side-loading indicator.

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

This rule detects the creation of the Process Explorer kernel driver under the file name PED.sys, which FIN7 AvNeutralizer drops to gain kernel access through a bring-your-own-vulnerable-driver technique. The renamed signed driver is loaded to terminate protected security processes. The specific renamed artifact rarely appears in legitimate deployments.

Suspicious HUI Loader Configuration Artifact Creation via hellokety.ini (via file_event)

This rule detects creation of the hellokety.ini configuration artifact referenced by HUI Loader variants in the Chinese Entanglement campaign. The file steers loading of the encrypted agent.data payload. This distinctive file name is not associated with legitimate software.

Suspicious Kimsuky Global Template Macro Persistence via Normal.dotm Modification (via file_event)

This rule detects modification of the Microsoft Word global template Normal.dotm, which Kimsuky abused to persist malicious macros across all Word sessions. The reconnaissance toolkit injects code into the template so that it runs whenever Word starts. Because users can legitimately customize this template, corroborating context should be reviewed.

Suspicious Microsoft Dev Tunnel Domain Resolution via DNS (via dns_query)

This rule detects DNS resolution of Microsoft dev tunnel endpoints under the devtunnels.ms domain, which Operation Digital Eye abused to tunnel command and control traffic through trusted Microsoft infrastructure. While the service is legitimate for developers, its presence on servers or non-developer hosts is a strong sign of covert tunneling.

Suspicious NetSupport client32 Persistence via Run Key from ProgramData

This rule detects a Run key value referencing client32.exe staged under ProgramData. ClickFix operators deploy the NetSupport remote access tool as client32.exe and persist it through the CurrentVersion Run key. A remote control agent auto-started from ProgramData is a common abuse of otherwise legitimate NetSupport Manager software.

Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)

This rule detects creation of a Run key value named NvidiaDriverUpdate for persistence. The Lazarus ClickFake Interview campaign registers this autorun entry to relaunch its loader while impersonating a driver updater. A Run value with this masquerading name is characteristic of the campaign persistence.

Suspicious TermService ServiceDll Hijack via Registry (via registry_set)

This rule detects modification of the TermService ServiceDll registry value used to hijack the Remote Desktop service host. The RATatouille intrusion repoints this value to a malicious DLL so its code loads inside the legitimate service for stealthy persistence and remote access. Overwriting the TermService ServiceDll is rarely legitimate and strongly indicates a service DLL hijack.

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

This rule detects a Word macro enabling programmatic access to the VBA object model by setting AccessVBOM in the Office Security registry key. This technique is used in the Double-Tap campaign linked to APT28 to allow further malicious VBA execution and lower macro security. Enabling AccessVBOM is a strong indicator of malicious document activity because legitimate users rarely toggle this setting.

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

This rule detects PowerShell script content that reconstructs a payload using bitwise XOR over character and integer conversions. The ErrTraffic ClickFix framework delivers this XORed loader through fake browser fix prompts on compromised WordPress sites. Byte level XOR decoding inside a script block is a common obfuscation used to hide downloader logic.

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

This rule detects PowerShell that reads or writes payload data under the HKCU Printers registry key while using DPAPI SecureString conversion. Gamaredon GammaSteel hides encrypted PowerShell stages in this uncommon location and decodes them with ConvertTo-SecureString at runtime. Combining the Printers key with SecureString cryptography in a script is a distinctive fileless staging pattern.

Malicious Reflective Assembly Loading via PowerShell (via ps_script)

This rule detects PowerShell reflectively loading a .NET assembly through the Reflection Assembly Load method. The multi-stage infection chains extract shellcode or a managed payload embedded in a JPEG and load it directly in memory to evade disk-based detection. Reflective assembly loading is a strong indicator of in-memory payload execution.