Sigma detection rules, expert-reviewed

Malicious Curl MSI Download to ProgramData via Process Creation

This rule detects curl.exe downloading a Windows Installer package into the ProgramData directory, the payload staging behavior of the Chaos ransomware msaRAT loader reported by Cisco Talos. The tool fetches update_ms.msi from an attacker IP and writes it to ProgramData before execution. Detecting this retrieval catches ingress of the MSI that unpacks the covert browser-based C2 implant.

Suspicious Child Process Spawned by Python Interpreter via Process Creation

This rule detects python.exe spawning living-off-the-land binaries such as calc.exe, curl.exe, cmd.exe, or powershell.exe, the import-time execution behavior of the malicious PyPI packages analyzed by Cisco Talos. Trojanized packages run payloads from __init__.py or setup.py the moment they are imported or installed. Flagging these child processes surfaces supply-chain code execution on developer and build hosts.

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

This rule detects cmd.exe spawning powershell.exe with an encoded command argument as seen in the KongTuke fake-CAPTCHA infection chain reported by Cisco Talos. Encoded PowerShell launched from a shell is used to run an in-memory downloader that pulls a second stage and beacons to attacker infrastructure. Catching this early breaks the chain before payload retrieval and anti-forensic cleanup occur.

Suspicious BadIIS Native Module Registration via cmd Copy

This rule detects cmd.exe copying an architecture-suffixed 32.dll or 64.dll module with forced overwrite, matching the BadIIS deployment that registers its malicious native IIS module by copying the payload DLL into place. Silent overwrite of a bitness-named module through cmd is part of installing the server-side backdoor. This behavior indicates BadIIS module installation on an IIS host.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Suspicious CloudZ RAT Payload Download via curl to ProgramData

This rule detects curl saving a remote file into the ProgramData Microsoft WindowsDoc directory, matching the CloudZ RAT staging chain that writes update.txt into a fabricated WindowsDoc folder. Downloading a payload directly into a Microsoft-themed ProgramData path masquerades attacker tooling as system content. This ingress behavior indicates active payload retrieval.

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

This rule detects the regasm.exe LOLBin executing against content staged under ProgramData, matching the CloudZ RAT which abuses regasm to load a dropped .NET assembly outside developer workflows. Legitimate use of regasm operates on assemblies in build or install directories, not ProgramData staging folders. Execution from this location signals proxied malicious code loading.

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

This rule detects a scheduled task created to run onstart as SYSTEM that launches regasm.exe, matching the CloudZ RAT which registers a boot-time task to execute its .NET loader through the regasm LOLBin. Chaining an onstart SYSTEM task to a trusted Microsoft signed binary gives the implant privileged persistence while evading application controls. This combination is a strong indicator of CloudZ deployment.

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

This rule detects execution of a binary named DownloadedOneDriveDocument.exe, matching the n8n webhook CAPTCHA campaign that delivers a modified Datto RMM agent under a document-themed filename. Naming a remote management installer to look like a downloaded OneDrive document tricks users into running the RMM foothold. Execution of this file indicates delivery of the abused remote access tooling.

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

This rule detects execution of the ThrottleStop utility which ships a vulnerable driver abused to disable endpoint protection. Ransomware operators in Japanese incidents load ThrottleStop as part of their EDR-killer tooling before encryption. Bring-your-own-vulnerable-driver tools let an actor terminate security software from kernel space.

Suspicious Local Account Creation via Net User in Pre-Ransomware Phase

This rule detects creation of a new account using net user with the add flag. Ransomware actors targeting Japanese organizations create rogue accounts such as Attacker1 for persistence before deploying encryption. New account creation during an intrusion often precedes hands-on ransomware staging.

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

This rule detects creation of a scheduled task that runs at system startup, matching the WSPrint persistence used by UAT-9244. The actor registers a task to relaunch a side-loaded implant on boot under a printing service name. Startup scheduled tasks provide durable persistence across reboots.

Suspicious Script Download via Curl and PowerShell by Dohdoor

This rule detects the curl utility downloading a batch or command script over HTTP. The Dohdoor campaign uses PowerShell wrapped curl requests to stage follow-on .bat and .cmd payloads. Fetching executable scripts through curl is characteristic of malware staging.

Malicious Native IIS Module Installation via Appcmd by UAT-8099

This rule detects registration of a native IIS module using appcmd. UAT-8099 installs malicious BadIIS modules to intercept web traffic on compromised servers. Rogue IIS modules give an actor passive persistence and traffic manipulation inside the web server process.

Suspicious Hidden Local Account Creation via Net User by UAT-8099

This rule detects creation of a local account whose name ends with a dollar sign which hides it from standard enumeration. UAT-8099 creates hidden accounts such as admin and mysql with a trailing dollar sign for stealthy persistence. Hidden accounts let an actor retain access while evading routine account audits.