Sigma detection rules, expert-reviewed

Suspicious Data Exfiltration Channel to Telegram or Discord via dns_query

This rule detects DNS queries to Telegram and Discord API endpoints from processes that are not standard messaging or browser clients, a command-and-control and exfiltration pattern used by STEALC and other information stealers. Attackers abuse these popular platforms to blend malicious traffic with legitimate service usage. Resolution of these domains by unexpected processes warrants investigation.

Malicious WmRAT Persistence via vcswin Run Key (via registry_set)

This rule detects a Run key value pointing to vcswin.exe, the persistence executable Bitter APT dropped in ProgramData to relaunch WmRAT at logon. The autostart entry references an attacker-staged binary rather than a legitimate application. A Run value pointing to vcswin.exe is a strong persistence indicator.

Malicious PlugX Persistence via LMIGuardian Update Run Key (via registry_set)

This rule detects creation of a Run key named LMIGuardian Update, the autostart persistence mechanism Mustang Panda used to relaunch the side-loaded PlugX loader at logon. The value name masquerades as a legitimate LogMeIn updater. A Run entry with this exact name is a strong persistence indicator.

Suspicious curl Download Spawned by Excel via IQY Attachment (via process_creation)

This rule detects Excel spawning a command shell that runs curl, the initial execution chain triggered by the malicious IQY attachment in the Bitter APT PTCL campaign. Office applications launching curl through cmd to fetch remote payloads is not legitimate document behavior. This parent-child chain indicates weaponized document execution.

Suspicious WMI Query Against Windows Defender Namespace via wmic (via process_creation)

This rule detects wmic querying the Windows Defender WMI namespace, used by Sandworm to inspect and manipulate antivirus exclusions during the KMS campaign. Direct wmic access to the Defender namespace is uncommon in normal operations. It often precedes tampering with protection settings.

Suspicious curl Execution over TOR SOCKS5 Proxy (via process_creation)

This rule detects curl.exe routing traffic through a local SOCKS5 proxy on the default TOR port, a command-and-control technique used by Sandworm to reach onion infrastructure. Legitimate enterprise software rarely tunnels curl over 127.0.0.1:9050. This strongly suggests covert C2 over TOR.

Malicious DcRAT Loader Execution via rundll32 from Microsoft-Activation-Scripts Directory (via process_creation)

This rule detects rundll32 loading a DLL from a Microsoft-Activation-Scripts directory, the staging path used by Sandworm to execute the DcRAT loader disguised as KMS activation tooling. Exporting a function from a DLL placed in this masquerading folder is not legitimate Windows behavior. This indicates hands-on-keyboard payload execution.

Malicious Latrodectus DLL Execution via rundll32 from AppData Roaming (via process_creation)

This rule detects rundll32 executing the vierm_soft_x64 DLL from AppData Roaming, the Latrodectus payload LUNAR SPIDER disguised as a legitimate NVIDIA file. The malicious DLL is dropped by an MSI installer and launched from a user profile directory. This combination indicates loader execution ahead of Brute Ratel deployment.

Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)

This rule detects PowerShell Start-BitsTransfer downloading a DLL into ProgramData, the ingress technique used against East Asian semiconductor firms to stage the ChargeWeapon loader module. BITS transfers of DLLs into ProgramData blend malicious downloads with a trusted service. This combination is a strong staging indicator.

Suspicious cmd Execution of .ucp Payload from System Volume Information (via process_creation)

This rule detects cmd.exe executing a .ucp file staged inside System Volume Information, a hiding technique used in the Mustang Panda PlugX chain. The renamed executable is launched from a directory normally reserved for restore points and shadow data. Execution of arbitrary payloads from this path is highly abnormal.

Malicious ChargeWeapon DLL Side-Loading via mcods.exe (via image_load)

This rule detects the McAfee mcods binary loading mcvsocfg.dll, the side-loading pair used to deliver the ChargeWeapon downloader in the semiconductor espionage campaign. The malicious loader reads an encrypted configuration and injects shellcode when loaded by the signed binary. This host and module combination is a reliable side-loading indicator.

Malicious HyperBro DLL Side-Loading via vfhost.exe (via image_load)

This rule detects the CyberArk vfhost binary loading VFTRACE.dll, the side-loading pair used to deploy the HyperBro implant against semiconductor targets. The malicious DLL decrypts and injects Cobalt Strike shellcode when loaded by the signed host process. This specific host and module pairing indicates HyperBro side-loading.

Malicious TALONITE GUP.exe Proxy Masquerading as Notepad++ Updater (via process_creation)

This rule detects execution of GUP.exe from any location outside the legitimate Notepad++ installation directory. TALONITE deploys a malicious proxy binary named GUP.exe to impersonate the genuine Notepad++ updater and blend into normal host activity. A GUP.exe running from a user, temp, or unexpected path indicates a masquerading C2 proxy rather than the real updater.

Suspicious Instant Messenger Client Spawning Script Interpreter (via process_creation)

This rule detects Discord or Telegram desktop clients spawning command shells and scripting interpreters as child processes. Adversaries abuse instant messaging platforms for command and control, using the legitimate client as a launch point for follow-on execution. A messaging application spawning cmd, PowerShell, or scripting hosts is anomalous and indicates malicious tooling masquerading as chat software.

Malicious VOLTZITE Netsh Portproxy Port Forwarding via Command Line (via process_creation)

This rule detects use of netsh.exe to create an interface portproxy rule that forwards network traffic between hosts. VOLTZITE leverages this native binary to relay traffic and pivot deeper into critical infrastructure networks. Attackers rely on portproxy forwarding to tunnel access through compromised systems while evading network segmentation controls.