Sigma detection rules, expert-reviewed

Malicious BADIIS Native IIS Module Loaded by Worker Process (via image_load)

This rule detects the IIS worker process loading the BADIIS native module DLL registered under the default application pool for SEO poisoning. Observed in Elastic Security Labs analysis where WsmRes64.dll is loaded by w3wp.exe to intercept and manipulate web traffic as a malicious IIS component.

Suspicious GHOSTPULSE DLL Side-Loading via Signed Binary

This rule detects the signed application Crysta_X64.exe loading the attacker-supplied DllXDownloadManager.dll, the DLL side-loading pair used to launch the GHOSTPULSE loader. Adversaries abuse this trusted executable to proxy execution of malicious code while evading application controls before deploying the ARECHCLIENT2 stealer.

Suspicious DLL Side-Loading by Microsoft.Http.Api.exe via HTTPService.dll

This rule detects Microsoft.Http.Api.exe loading HTTPService.dll from a user AppData directory as part of the SHELBY backdoor DLL side-loading chain. The signed decoy executable is abused to load an attacker-controlled DLL that stages further payloads. This behavior indicates DLL search-order hijacking used to evade application controls and establish execution.

Malicious TELEPUZ DLL Persistence via Masqueraded Loader in User Path

This rule detects TELEPUZ writing its loader DLLs with system-sounding names into user-writable AppData or ProgramData locations. Legitimate components with these names live under System32, so the same filenames in a profile directory signal masquerading. This combination of trusted-looking name and wrong path exposes the DLL persistence.

Malicious BADIIS Driver Dropped to System32 Drivers Directory (via file_event)

This rule detects the BADIIS malicious kernel driver payloads being written into the System32 drivers directory under masquerading filenames. Observed in Elastic Security Labs analysis of the global SEO poisoning campaign where WUDFPfprot.sys, WppRecorderpo.sys, and WppRecorderrt.sys are dropped to establish a stealthy foothold.

Suspicious NANOREMOTE Execution Log File Creation

This rule detects creation of a pe_exe_run.log file inside a Log subdirectory, an artifact the NANOREMOTE backdoor writes into its execution directory when running payloads. This distinctive log path helps identify hosts where the implant has executed additional binaries.

Suspicious TOLLBOOTH IIS Module Files in Windows Temp

This rule detects file creation under the C:\Windows\Temp\AcpLogs staging directory used by the TOLLBOOTH native IIS module for its configuration and log files. Persistent IIS module artifacts written to a temp directory indicate a covert web server implant.

Malicious Shai-Hulud Workflow File Creation

This rule detects creation of a shai-hulud-workflow.yml file, the malicious GitHub Actions workflow dropped by the Shai-Hulud npm supply-chain worm to establish persistence and propagate through developer repositories. The distinctive filename is a reliable indicator of compromise.

Suspicious REMCOS Screenshot Capture File via file_event

This rule detects creation of screenshot image files matching the REMCOS RAT naming convention that prefixes captures with time_ followed by a timestamp and a jpg extension. The malware periodically captures the victim screen for surveillance and stores images using this pattern. Discovery of such files indicates active spyware collection.

Suspicious EAGERBEE Configuration File Created in Public User Directory via File Event

This rule detects creation of an iconcache.mui file in the public user directory which the REF5961 EAGERBEE backdoor uses as its configuration store. The masqueraded cache filename in a world-writable directory is a defense evasion technique to hide malware configuration in plain sight.

Malicious ABYSSWORKER EDR-Killer Driver Load via smuol.sys

This rule detects the load of the smuol.sys kernel driver associated with the ABYSSWORKER EDR-killer. The driver masquerades as a legitimate CrowdStrike component and exposes IOCTL handlers used to terminate or blind endpoint security products. Loading this driver indicates an attacker attempting to disable defenses to enable further intrusion activity.

Suspicious DNS Query for Tor Onion Domain

This rule detects DNS queries for .onion top-level domains, which correspond to Tor hidden services. Malware uses .onion command-and-control and exfiltration endpoints to anonymize traffic, and standard DNS resolution of .onion names is unusual on enterprise networks, indicating a Tor proxy or DNS-tunneling C2 channel.

Possible DNS Tunneling via Excessively Long Query Name

This rule detects DNS queries with abnormally long names exceeding one hundred characters, a covert exfiltration signal described by Elastic for detecting DNS tunneling. Attackers encode stolen data into the subdomain labels of DNS requests to smuggle it past network controls over an allowed protocol. Sustained long query names to a single domain are a strong indicator of tunneling and merit investigation.

Suspicious Data Exfiltration Channel to Telegram or Discord via dns_query

This rule detects DNS queries to Telegram and Discord API endpoints from processes that are not standard messaging or browser clients, a command-and-control and exfiltration pattern used by STEALC and other information stealers. Attackers abuse these popular platforms to blend malicious traffic with legitimate service usage. Resolution of these domains by unexpected processes warrants investigation.

Malicious WmRAT Persistence via vcswin Run Key (via registry_set)

This rule detects a Run key value pointing to vcswin.exe, the persistence executable Bitter APT dropped in ProgramData to relaunch WmRAT at logon. The autostart entry references an attacker-staged binary rather than a legitimate application. A Run value pointing to vcswin.exe is a strong persistence indicator.