Sigma detection rules, expert-reviewed

Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking

This rule detects trusted scripting and automation interpreters such as AutoHotkey JamPlus Lua or Node.js executing from user download or temporary directories which is the reputation hijacking technique used to bypass Smart App Control. Adversaries plant a malicious script alongside a reputable interpreter binary so the resulting execution inherits the interpreter good reputation to evade defenses.

Suspicious Explorer Executing Path With Trailing Dot via LNK Stomping

This rule detects process execution where the parent explorer.exe launches a target whose command line contains a malformed path element such as a trailing dot or a leading dot-slash which is characteristic of LNK stomping used to strip the Mark-of-the-Web and bypass Smart App Control. Adversaries craft non-standard shortcut targets so explorer canonicalizes and overwrites them removing MotW reputation checks before execution.

Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER

This rule detects dllhost.exe launched by mmc.exe with an empty or missing command line which is characteristic of the PASTALOADER stage of GrimResource where shellcode is injected into a freshly spawned dllhost.exe process. Adversaries use this sacrificial COM surrogate combined with DirtyCLR unhooking and indirect syscalls to stealthily load Cobalt Strike.

Suspicious MMC Console Loading MSC File From User Writable Path

This rule detects mmc.exe opening a Microsoft Management Console snap-in file from a user writable directory such as Downloads or Temp which is characteristic of GrimResource where a malicious MSC like sccm-updater.msc is delivered for initial access. Attackers abuse the trusted MMC binary to evade defenses and gain code execution outside the standard administrative snap-in locations.

Suspicious MMC Console Spawning Script Interpreter via GrimResource

This rule detects mmc.exe spawning a script interpreter or scripting host child process which occurs when a crafted MSC file abuses the apds.dll cross-site scripting flaw to execute JavaScript inside mmc.exe as used in the GrimResource technique. Adversaries leverage this MMC initial access and evasion chain to run DotNetToJScript and side-load the PASTALOADER shellcode loader delivering Cobalt Strike.

Malicious WARMCOOKIE Loader Execution via rundll32 RtlUpd via process_creation

This rule detects rundll32.exe executing the WARMCOOKIE backdoor DLL RtlUpd.dll with its Start export. The backdoor is dropped to the ProgramData RtlUpd directory and invoked through rundll32 for execution and persistence. This specific module and export combination is a high-confidence WARMCOOKIE indicator.

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

This rule detects PowerShell using the BITS transfer cmdlet to download a DLL payload, matching the WARMCOOKIE backdoor delivery chain initiated from a malicious JavaScript file. The technique leverages the background intelligent transfer service to retrieve the loader while evading some download monitoring. A DLL fetched by Start-BitsTransfer through PowerShell is highly suspicious.

Malicious GHOSTENGINE Scheduled Task Creation Masquerading as Updater via process_creation

This rule detects creation of scheduled tasks using GHOSTENGINE masquerade names such as OneDriveCloudSync DefaultBrowserUpdate and OneDriveCloudBackup that run payloads as SYSTEM. These tasks impersonate legitimate update services to persist the crypto mining operation. The specific task names are strong indicators of this intrusion set.

Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation

This rule detects a masquerading TiWorker.exe process spawning PowerShell to fetch a remotely hosted payload disguised as a PNG image, matching the GHOSTENGINE crypto mining infection chain. The legitimate TiWorker.exe is a Windows Modules Installer worker and does not normally launch PowerShell download activity. This behavior indicates process masquerading for initial payload retrieval.

Suspicious Scheduled Task Updater Creation for Loader Persistence via process_creation

This rule detects creation of a scheduled task named Updater configured to run at user logon via schtasks and re-launch a loader DLL through rundll32, a persistence mechanism used by LATRODECTUS. The task mimics legitimate software while re-executing the implant to survive reboots. The logon trigger combined with rundll32 execution is suspicious.

Suspicious Alternate Data Stream Self-Deletion via process_creation

This rule detects references to the wtfbbq alternate data stream used by the LATRODECTUS loader to self-delete after execution and remove forensic traces. The malware moves itself into this named stream to evade file-based detection and cleanup. The distinctive stream name is a reliable indicator of this loader family.

Malicious UAC Bypass via ICMLuaUtil COM Elevation via process_creation

This rule detects the auto-elevating COM object ICMLuaUtil being invoked through dllhost.exe to bypass User Account Control, a technique used by the REMCOS RAT for silent privilege escalation. The malware leverages the CMSTPLUA elevation moniker to execute commands with administrative rights without prompting the user. This behavior is a reliable indicator of UAC bypass activity.

Suspicious Browser History Dumping via NirSoft Tool via process_creation

This rule detects execution of the NirSoft BrowsingHistoryView utility, which the REMCOS RAT abuses through its DumpBrowserHistoryUsingNirsoft command to collect victim browsing data. Attackers stage this signed third-party tool to harvest history for reconnaissance and credential context. Its appearance outside sanctioned administrative use is suspicious.

Malicious WannaCry Decryptor Launching Tor via process_creation

This rule detects the WannaCry ransom note component WanaDecryptor spawning the bundled tor.exe used for anonymous communication with the operators. This activity supports the ransomware payment and command channel over the Tor network. Its presence confirms a WannaCry infection reaching the ransom stage.

Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation

This rule detects the WannaCry payload tasksche.exe being launched by its dropper service process mssecsvc.exe. This parent-child relationship reflects the core WannaCry infection chain where the network worm component deploys the encryptor. Observing this process lineage indicates an active WannaCry compromise.