Sigma detection rules, expert-reviewed

Malicious ABYSSWORKER EDR-Killer Driver Load via smuol.sys

This rule detects the load of the smuol.sys kernel driver associated with the ABYSSWORKER EDR-killer. The driver masquerades as a legitimate CrowdStrike component and exposes IOCTL handlers used to terminate or blind endpoint security products. Loading this driver indicates an attacker attempting to disable defenses to enable further intrusion activity.

Suspicious DNS Query for Tor Onion Domain

This rule detects DNS queries for .onion top-level domains, which correspond to Tor hidden services. Malware uses .onion command-and-control and exfiltration endpoints to anonymize traffic, and standard DNS resolution of .onion names is unusual on enterprise networks, indicating a Tor proxy or DNS-tunneling C2 channel.

Possible DNS Tunneling via Excessively Long Query Name

This rule detects DNS queries with abnormally long names exceeding one hundred characters, a covert exfiltration signal described by Elastic for detecting DNS tunneling. Attackers encode stolen data into the subdomain labels of DNS requests to smuggle it past network controls over an allowed protocol. Sustained long query names to a single domain are a strong indicator of tunneling and merit investigation.

Suspicious Data Exfiltration Channel to Telegram or Discord via dns_query

This rule detects DNS queries to Telegram and Discord API endpoints from processes that are not standard messaging or browser clients, a command-and-control and exfiltration pattern used by STEALC and other information stealers. Attackers abuse these popular platforms to blend malicious traffic with legitimate service usage. Resolution of these domains by unexpected processes warrants investigation.

Malicious WmRAT Persistence via vcswin Run Key (via registry_set)

This rule detects a Run key value pointing to vcswin.exe, the persistence executable Bitter APT dropped in ProgramData to relaunch WmRAT at logon. The autostart entry references an attacker-staged binary rather than a legitimate application. A Run value pointing to vcswin.exe is a strong persistence indicator.

Malicious PlugX Persistence via LMIGuardian Update Run Key (via registry_set)

This rule detects creation of a Run key named LMIGuardian Update, the autostart persistence mechanism Mustang Panda used to relaunch the side-loaded PlugX loader at logon. The value name masquerades as a legitimate LogMeIn updater. A Run entry with this exact name is a strong persistence indicator.

Suspicious curl Download Spawned by Excel via IQY Attachment (via process_creation)

This rule detects Excel spawning a command shell that runs curl, the initial execution chain triggered by the malicious IQY attachment in the Bitter APT PTCL campaign. Office applications launching curl through cmd to fetch remote payloads is not legitimate document behavior. This parent-child chain indicates weaponized document execution.

Suspicious WMI Query Against Windows Defender Namespace via wmic (via process_creation)

This rule detects wmic querying the Windows Defender WMI namespace, used by Sandworm to inspect and manipulate antivirus exclusions during the KMS campaign. Direct wmic access to the Defender namespace is uncommon in normal operations. It often precedes tampering with protection settings.

Suspicious curl Execution over TOR SOCKS5 Proxy (via process_creation)

This rule detects curl.exe routing traffic through a local SOCKS5 proxy on the default TOR port, a command-and-control technique used by Sandworm to reach onion infrastructure. Legitimate enterprise software rarely tunnels curl over 127.0.0.1:9050. This strongly suggests covert C2 over TOR.

Malicious DcRAT Loader Execution via rundll32 from Microsoft-Activation-Scripts Directory (via process_creation)

This rule detects rundll32 loading a DLL from a Microsoft-Activation-Scripts directory, the staging path used by Sandworm to execute the DcRAT loader disguised as KMS activation tooling. Exporting a function from a DLL placed in this masquerading folder is not legitimate Windows behavior. This indicates hands-on-keyboard payload execution.

Malicious Latrodectus DLL Execution via rundll32 from AppData Roaming (via process_creation)

This rule detects rundll32 executing the vierm_soft_x64 DLL from AppData Roaming, the Latrodectus payload LUNAR SPIDER disguised as a legitimate NVIDIA file. The malicious DLL is dropped by an MSI installer and launched from a user profile directory. This combination indicates loader execution ahead of Brute Ratel deployment.

Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)

This rule detects PowerShell Start-BitsTransfer downloading a DLL into ProgramData, the ingress technique used against East Asian semiconductor firms to stage the ChargeWeapon loader module. BITS transfers of DLLs into ProgramData blend malicious downloads with a trusted service. This combination is a strong staging indicator.

Suspicious cmd Execution of .ucp Payload from System Volume Information (via process_creation)

This rule detects cmd.exe executing a .ucp file staged inside System Volume Information, a hiding technique used in the Mustang Panda PlugX chain. The renamed executable is launched from a directory normally reserved for restore points and shadow data. Execution of arbitrary payloads from this path is highly abnormal.

Malicious ChargeWeapon DLL Side-Loading via mcods.exe (via image_load)

This rule detects the McAfee mcods binary loading mcvsocfg.dll, the side-loading pair used to deliver the ChargeWeapon downloader in the semiconductor espionage campaign. The malicious loader reads an encrypted configuration and injects shellcode when loaded by the signed binary. This host and module combination is a reliable side-loading indicator.

Malicious HyperBro DLL Side-Loading via vfhost.exe (via image_load)

This rule detects the CyberArk vfhost binary loading VFTRACE.dll, the side-loading pair used to deploy the HyperBro implant against semiconductor targets. The malicious DLL decrypts and injects Cobalt Strike shellcode when loaded by the signed host process. This specific host and module pairing indicates HyperBro side-loading.