Sigma detection rules, expert-reviewed

RunningRAT Service Persistence via svchost NETSYSDDL Group (via process_creation)

This rule detects svchost.exe launched with the NETSYSDDL service group used by RunningRAT to load its malicious DLL under a masqueraded service. Adversaries leverage the svchost hosting model so the RAT executes as a service and survives reboots while blending into legitimate host processes.

Suspicious Mshta Remote HTA Execution via process_creation

This rule detects mshta.exe executing a command line that contains a web URL which indicates it is fetching and running a remote HTML Application. SideWinder used mshta.exe to pull a remote HTA that ran JavaScript through mshtml RunHTMLApplication and WScript Shell. Remote HTA execution is a well known proxy execution technique used to bypass application controls.

EchoGather Backdoor Components Dropped to User Windows Profile Directory (via file_event)

This rule detects creation of the EchoGather backdoor and its PowerShell loaders inside the roaming Microsoft Windows profile directory used by the Paper Werewolf campaign. Writing these specific filenames into a user profile path reflects the backdoor being staged for persistence after the malicious XLL executes.

Malicious FortiClient Process Spawning PowerShell Downloader (via process_creation)

This rule detects the FortiClient fortitray.exe or ipsec.exe process spawning a command shell or PowerShell. Exploitation of CVE-2026-35616 in FortiClient EMS delivered the EKZ infostealer through this process chain disguised as a Fortinet endpoint patch.

Suspicious Service BinPath Set to Command Interpreter or Account Creation

This rule detects use of sc.exe to set a service binary path to a command interpreter or a local account creation command, the service-abuse primitive used in the CVE-2019-1322 Update Orchestrator Service escalation to add a local administrator as SYSTEM. Pointing a service binPath at cmd or a net user add command is a common hijack for privilege escalation and persistence.

Suspicious Remote Archive Retrieval via mshta in Malware Distribution Ecosystem

This rule detects mshta.exe invoked with an HTTP or HTTPS URL pointing to a .7z archive, the delivery step used by the click-hijacking and TDS ecosystem to fetch stager payloads such as navy.7z. mshta retrieving a remote archive is a living-off-the-land proxy-execution behavior seldom seen in benign use.

Malicious Bun Runtime Payload Dropped by Shai Hulud npm Supply Chain Attack

This rule detects creation of the setup_bun.js or bun_environment.js files associated with the Shai Hulud 2.0 npm supply-chain worm. A malicious preinstall script drops setup_bun.js which installs the Bun runtime and stages the large bun_environment.js payload for credential theft and self-propagation. These distinctive filenames written during package installation indicate the worm establishing execution.

Malicious Scheduled Task MicrosoftsUpdate Loading DLL Web Shell (via process_creation)

This rule detects creation of a scheduled task named MicrosoftsUpdate via schtasks. In the HrServ APT web shell intrusion the actor registers a task with this masquerading name to load hrserv.dll for persistence, so this misspelled Microsoft-lookalike task name indicates the malicious loader being installed.

Suspicious LocalAccountTokenFilterPolicy Registry Modification

This rule detects modification of the LocalAccountTokenFilterPolicy value, which disables remote UAC filtering so local admin accounts retain full privileges over the network. Play ransomware operators set this to ease lateral movement.

Malicious Kimsuky Run Key Autostart to desktop.ini.bak in Public Folder (via registry_set)

This rule detects a Run key persistence value pointing to a masqueraded desktop.ini.bak file under C:\Users\Public, a technique used by Kimsuky to autostart its VBS/PowerShell keylogger against Japanese targets. The abuse of a system-looking filename in a world-writable public path is intended to blend persistence into normal-looking artifacts.

Suspicious AMSI Bypass via AmsiScanBuffer Patching (via ps_script)

This rule detects PowerShell script blocks that reference AmsiScanBuffer together with VirtualProtect, the combination used to patch the Antimalware Scan Interface in memory. This AMSI bypass technique disables in-memory scanning so obfuscated loaders delivering Agent Tesla and XWorm can execute undetected.

Malicious Chaos Ransomware Ransom Note and Encrypted Extension (via file_event)

This rule detects Chaos C++ ransomware writing the ransom note READ_IT.txt into the AppData folder and appending the .chaos extension to encrypted files. Creation of these artifacts indicates active encryption by the locker. The malware also drops debug logs under the temp folder.

Malicious Ransomware Encryptor Execution with Password Gate (via process_creation)

This rule detects a binary launched with password and no-admin arguments characteristic of the Qilin ransomware encryptor. Operators executed the encryptor with a long password and a no-admin flag to skip UAC prompts during mass encryption.

Suspicious AppLaunch Process Hollowing Target

This rule detects execution of the .NET AppLaunch.exe host outside of legitimate Visual Studio contexts. This behavior matches HeartCrypt which performs process hollowing into AppLaunch.exe and csc.exe to run decrypted payloads under a trusted binary. AppLaunch.exe spawned by unexpected parents is a hollowing indicator used to disguise malicious code as a signed Microsoft process.

Malicious Mimikatz Credential Access Module Invocation

This rule detects command lines invoking Mimikatz credential-access modules such as privilege debug sekurlsa logonPasswords or lsadump sam. The BabyLockerKZ MedusaLocker operator used these Mimikatz modules to dump credentials during pre-encryption operations. Chained privilege debug and LSASS or SAM dumping commands are unambiguous credential-theft activity preceding lateral movement and ransomware.