Sigma detection rules, expert-reviewed

Suspicious AppCertDlls Registry Modification for DLL Injection

This rule detects creation or modification of AppCertDlls registry values, which load a specified DLL into any process that calls the Win32 process-creation APIs. Attackers abuse this key for stealthy code injection and persistence across newly spawned processes.

Suspicious AppInit_DLLs Registry Modification for DLL Injection

This rule detects modification of the AppInit_DLLs registry value, which forces the listed DLLs to load into every process that links user32.dll. Adversaries set this value to achieve system-wide DLL injection and persistence, as surveyed in Elastic's review of common process injection techniques.

Possible SHELBY Backdoor Persistence via Run Key Referencing AppData HTTPApi

This rule detects creation of a CurrentVersion Run key value that points to the HTTPApi staging folder under AppData, the autorun persistence used by the SHELBY backdoor. A Run key referencing a per-user AppData executable indicates malware ensuring execution at logon.

Suspicious PowerShell Persistence via Registry Run Key

This rule detects creation of a Run key value that launches PowerShell at user logon, matching the RegistryPersistence Beacon Object File demonstrated in Elastic testing of Cobalt Strike detection gaps. Adversaries write a PowerShell payload to the CurrentVersion Run key so their implant re-executes on every startup. A Run entry that invokes PowerShell is a common autostart persistence pattern worth reviewing.

Suspicious Service Registration via Svchost netsvcs Registry Modification

This rule detects modification of the Svchost netsvcs registry value, abused by the SADBRIDGE loader to register a malicious service that is hosted by svchost.exe and delivers the GOSAR backdoor. Adding an entry to the netsvcs service group lets the attacker run code inside a trusted host process for stealthy persistence. Changes to this value outside of software installation warrant investigation.

Malicious UAC Disable via EnableLUA Registry Modification via registry_set

This rule detects modification of the EnableLUA policy value to zero under the system policies key, which disables User Account Control. The REMCOS RAT performs this change to weaken host defenses and enable silent privilege escalation. Disabling UAC system-wide is rarely legitimate and represents a significant defense evasion action.

Suspicious Run Key Persistence Pointing to Test Executable via Registry Set

This rule detects a CurrentVersion Run key being set to launch an executable dropped inside a Test subdirectory which is the autostart persistence used by the BLOODALCHEMY backdoor. A run key value referencing this staging path indicates malware establishing boot persistence.

Suspicious PowerShell WMI Video Controller Sandbox Evasion Check via OXLoader

This rule detects PowerShell querying the WMI Win32 VideoController class to inspect display refresh rate as a sandbox and virtualization check used by the OXLoader loader in Elastic research. Malware probes video controller properties to detect analysis environments before deploying the CASTLESTEALER payload, so this query in a script block signals evasion logic.

Suspicious PowerShell Outlook COM Automation for Mail Access via TCLBANKER

This rule detects PowerShell attaching to a running Outlook instance through the COM automation interface as used by the TCLBANKER trojan to read victim mail in Elastic research. Using GetActiveObject on the Outlook Application object allows the malware to harvest messages and monitor the inbox for banking interactions.

Suspicious PowerShell Remote Download of PhantomPulse Stager

This rule detects PowerShell using Invoke WebRequest or Start BitsTransfer to retrieve the PhantomPulse stager scripts and syncobs executable documented in Elastic research on Obsidian abuse. Fetching a remote first stage over web requests inside a script block indicates the loader phase of the RAT infection.

Malicious AMSI and ETW Bypass via In-Memory Patching (via ps_script)

This rule detects PowerShell in-memory tampering with AMSI and ETW to blind endpoint defenses, used by the MIMICRAT loader. Observed in Elastic Security Labs analysis where amsiInitFailed forcing, EventProvider m_enabled zeroing, and ScanContent Marshal.Copy patching disable scanning and telemetry before staging the RAT.

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

This rule detects execution of the DYNOWIPER PowerShell loader scripts that stage and launch the destructive wiper against Poland's energy sector. Observed in Elastic Security Labs telemetry where dynacon_update.ps1 or exp.ps1 orchestrate dropping and running the wiper binary, indicating imminent data destruction.

Malicious ClickFix Clipboard Command Execution via PowerShell

This rule detects PowerShell command lines that download remote content with Invoke-WebRequest and immediately pipe it into Invoke-Expression, a pattern used by ClickFix social-engineering lures. This tradecraft was observed delivering GHOSTPULSE and the ARECHCLIENT2 information stealer, where victims are tricked into pasting a clipboard command into the Run dialog to fetch and run a next-stage payload in memory.

Suspicious PowerShell AMSI or ETW Tampering

This rule detects PowerShell script content that patches or disables the Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW), a defense-evasion technique used to blind in-memory scanning and telemetry before executing malicious payloads. Such tampering is a hallmark of offensive tooling that seeks to run undetected in memory.

Malicious Contagious Interview RAT via Masqueraded Service Binary in User Path

This rule detects execution of service-sounding binaries dropped by the Contagious Interview toolkit from a user profile directory rather than a system location. The North Korean operators name their implants to imitate host, print and DHCP services to blend in. Running such a binary out of a user path is a strong masquerading indicator of the second-stage RAT.