Sigma detection rules, expert-reviewed

Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory

This rule detects bitsadmin transferring a remote file into the world-writable C\Users\Public directory which SCMBanker uses to stage its fraud toolkit after initial access. Living-off-the-land BITS transfers evade download monitoring and blend with legitimate update traffic. The public staging path is a strong indicator of malicious payload delivery.

Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader

This rule detects a batch script masquerading as an installer that spawns PowerShell to download a remote executable as used by the OXLoader loader chain delivering CASTLESTEALER in Elastic research. A cmd hosted bat launching PowerShell with a download command is an early stage indicator of the fake installer social engineering lure.

Suspicious Scheduled Task Under NetFramework Path via PHANTOMPULSE

This rule detects creation of scheduled tasks placed in the Microsoft Windows NetFramework folder with implant specific names such as DotNetSvcUpdateTask or CoreTask as used by the PHANTOMPULSE RAT in Elastic research. Registering tasks under this seldom populated system path with update themed names provides masqueraded persistence for the backdoor.

Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise

This rule detects a PowerShell binary renamed to wt.exe and executed from the ProgramData directory as seen in the Axios npm supply chain compromise. The RAT masquerades its interpreter to evade process name based detection and blend with Windows Terminal, enabling stealthy execution of downloaded payloads.

Suspicious Sleep and Hibernate Disabled via Powercfg for Mining (via process_creation)

This rule detects powercfg being used to zero standby and hibernate timeouts so the host never sleeps, keeping a cryptominer running continuously. Observed in the Elastic Security Labs fake-installer Monero mining operation where power settings are altered to maximize resource hijacking uptime.

Malicious BRUSHLOGGER Rundll32 Execution from ProgramData (via process_creation)

This rule detects rundll32 loading the BRUSHLOGGER Recorder.dll from the attacker's ProgramData staging directory. Observed in Elastic Security Labs analysis where Recorder.dll under a Photoes Pics path is executed to capture keystrokes from financial services targets.

Malicious ScreenConnect Client Installation via Msiexec (via process_creation)

This rule detects silent installation of the ScreenConnect client setup MSI, abused in the SILENTCONNECT campaign to deploy remote access tooling. Observed in Elastic Security Labs telemetry where msiexec installs ScreenConnect.ClientSetup.msi to give the adversary persistent hands-on-keyboard control.

Suspicious ClickFix PowerShell Execution with Hidden Window (via process_creation)

This rule detects PowerShell launched with an abbreviated hidden window style argument combined with string reconstruction, a pattern used by ClickFix clipboard lures delivering MIMICRAT. Observed in Elastic Security Labs telemetry where powershell -WInDo Min hides the console while string-slicing rebuilds the attacker domain to fetch the custom RAT.

Suspicious Office Application Spawning Interpreter via DDEAUTO (via process_creation)

This rule detects Microsoft Office applications spawning command shells or scripting interpreters, the hallmark of Dynamic Data Exchange DDEAUTO field abuse for code execution. Observed in Elastic Security Labs root cause analysis where winword.exe launches mshta, powershell, or cmd from a weaponized document to run attacker payloads.

Malicious Service ACL Tampering via Sc Sdset (via process_creation)

This rule detects use of sc sdset to rewrite a service security descriptor, hardening a malicious service against inspection or removal. Observed in the BADIIS SEO poisoning campaign analyzed by Elastic Security Labs where the WalletServiceInfo service ACL is tampered to protect the implant for defense evasion and persistence.

Suspicious Remote MSI Installation of RMM Tooling via Msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package hosted at a remote URL, a technique used after SolarWinds Web Help Desk exploitation to deploy remote monitoring and management tooling such as Velociraptor and cloudflared. Observed in Elastic Security Labs telemetry where quiet remote MSI installs establish attacker persistence and command channels.

Malicious Print Spooler Child Process Execution via PrintNightmare (via process_creation)

This rule detects the Windows print spooler service spawning command shells or scripting interpreters, a behavior consistent with exploitation of the PrintNightmare vulnerability CVE-2021-34527. Observed in Elastic Security Labs GOAD lab telemetry where spoolsv.exe launching unusual child processes indicates remote code execution as SYSTEM for privilege escalation.

Suspicious WMLOADER Masquerading as BDReinit Outside Install Path

This rule detects a process named BDReinit.exe running from a location other than a legitimate Bitdefender installation directory, the masquerading technique used by the WMLOADER component that deploys NANOREMOTE. Renaming the loader to a trusted security-product binary in an unexpected path helps it blend in while it reads its wmsetup.log configuration.

Suspicious Encoded PowerShell Execution with No Profile

This rule detects PowerShell launched with the -noprofile flag alongside an encoded command argument, the launcher pattern seen delivering the FORMBOOK payload dllhostSvc.exe. Combining profile suppression with base64-encoded commands is a common obfuscation used to hide the downloaded second stage.

Malicious Equation Editor Child Process Indicating Exploit

This rule detects the Microsoft Equation Editor eqnedt32.exe spawning any child process, which indicates successful exploitation of an Office document delivering the FORMBOOK stealer. The legitimate equation editor never launches other executables, so any child process is a high-confidence exploit signal.