Sigma detection rules, expert-reviewed

Suspicious Deno Runtime Execution of Remote JavaScript Payload (via process_creation)

This rule detects the Deno JavaScript runtime executing a payload retrieved from a remote HTTP or HTTPS URL, the second stage of a ClickFix campaign that abuses the Deno runtime to deliver an infostealer. Legitimate use of Deno to run code directly from a remote web address on an endpoint is uncommon.

Suspicious NSSM Service Installation via process_creation

This rule detects the Non-Sucking Service Manager nssm.exe being used with the install argument to register an arbitrary program as a Windows service. Head Mare and Twelve used nssm to install persistence for masqueraded tunneling tools such as rclone and gost. Because nssm is not a default Windows binary its use to install services is a strong persistence signal.

Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation

This rule detects an IIS worker process spawning cmd or PowerShell that runs base64 encoded payloads, behavior observed during active exploitation of Gladinet CentreStack and Triofox local file inclusion flaws. Attackers leverage the web application context to achieve remote code execution and stage further tooling. Web servers rarely spawn encoded interpreters, so this indicates likely post-exploitation activity.

Suspicious Python Payload Execution from ProgramData via Pythonw (via process_creation)

This rule detects pythonw.exe executing a .pyw script staged under ProgramData, the loader behavior of the malicious PyPI packages that drop server.pyw to C ProgramData after installation. Running a windowless Python payload from ProgramData indicates supply-chain malware execution.

Suspicious SharePoint w3wp Spawning Encoded PowerShell (ToolShell Exploitation)

This rule detects the SharePoint IIS worker w3wp spawning PowerShell with an encoded command, the post exploitation activity following ToolShell webshell deployment. It matters because encoded PowerShell launched by the web server process indicates server side code execution and obfuscated attacker commands.

Malicious Software Protection Service Masquerade Outside System32 via Process Creation

This rule detects the legitimate software protection service binary name sppsvc being executed from any location other than System32 which reflects the masquerading observed in this intrusion where the process ran from a hidden ProgramData directory. The genuine service only runs from System32 so execution elsewhere indicates a masqueraded malicious process.

Suspicious Scheduled Task Masquerading as Memory Diagnostic Running Script Host

This rule detects creation of a scheduled task named RunFullMemoryDiagnostic or ProcessMemoryDiagnosticEvents whose action launches a script host, mimicking legitimate Windows memory diagnostic tasks. LitterDrifter abuses these trusted task names to blend its persistence into normal Windows components. The mismatch between the trusted name and a script host action reveals the worm persistence.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil.exe clearing Windows event logs which generates cleared-log events such as EventID 1102 and 104. LockBit operators wiped logs to destroy forensic evidence after exploitation and credential theft. Log clearing is a deliberate anti-forensic action rarely performed by legitimate administrators at scale.

Suspicious MSIEXEC Launching NVIDIA GeForce Experience Named Binary

This rule detects msiexec.exe launching a child process named nvidia geforce experience.exe, the delivery chain observed in the Genesis Market malicious browser extension campaign where an MSI dropped a legitimately named host binary for DLL sideloading. This sequence points to masquerading and side-loaded payload staging.

Suspicious Process Execution from Public User Media Folders via process_creation

This rule detects executables launched directly from the Public Pictures, Music, or Documents folders. This staging location is abused by fake OpenClaw installers delivering GhostSocks to run payloads from world-writable directories that rarely host legitimate executables, helping the operator evade path-based scrutiny.

Suspicious Run Key Persistence Executing Node.js Script via MuddyWater Tsundere Botnet

This rule detects a Run key autostart entry that launches the Node.js interpreter against a JavaScript payload. This behavior is tied to the MuddyWater APT Tsundere botnet which resolves its command and control from an Ethereum smart contract using EtherHiding. Persisting node.exe via the Run key lets the operator survive reboots and maintain WebSocket beaconing.

Suspicious Password-Protected Archive Extraction of Everything64.dll by Elpaco Ransomware

This rule detects 7-Zip command-line extraction of a password-protected archive that deploys the Everything64.dll component. Elpaco ransomware, a Mimic variant, abuses the legitimate Everything search library for fast file enumeration prior to encryption. Password-protected extraction of this specific payload indicates staging of ransomware tooling on the host.

Suspicious Browser Login Data Copied to Temp File via type Command

This rule detects use of the cmd type command to copy a browser Login Data credential store into a temporary file. In SocGholish activity the stolen store was redirected into a rad prefixed tmp file for later DPAPI decryption. Copying the credential database is a precursor to bulk password theft from the endpoint.

Malicious COM Object Hijack Pointing to a User-Writable DLL (via registry_set)

This rule detects a CLSID InprocServer32 default value being pointed at a DLL in a user, temp or public directory, the hallmark of COM hijacking used for stealthy persistence and defense evasion. COM hijacking is a persistence technique profiled in the Red Canary Threat Detection Report. Detecting a COM object redirected to a user-writable payload surfaces a persistence mechanism before it is invoked.

Suspicious High Frequency Scheduled Task Creation via Schtasks

This rule detects creation of a scheduled task configured to run every few minutes which the TorNet backdoor uses to repeatedly relaunch its loader under a randomized task name. Minute interval recurring tasks are unusual for legitimate software and indicate persistence with frequent re execution.