Sigma detection rules, expert-reviewed

Suspicious Staged Payload Execution from User Downloads or Pictures Folder

This rule detects execution of attacker-staged binaries with names such as FunnyApp.exe, RedSun.exe, or z.exe from user Downloads or Pictures folders. These payloads were staged during a Huntress-investigated intrusion following VPN access and used to advance the attack, including bring-your-own-vulnerable-driver activity. Execution of these specific filenames from staging directories indicates deployment of hands-on-keyboard tooling.

Malicious NotDoor Outlook VBA Persistence via VbaProject.OTM Deployment (via process_creation)

This rule detects command lines that copy a staging file into the Outlook VbaProject.OTM macro container used by the NotDoor backdoor for persistence. Overwriting VbaProject.OTM lets attacker VBA code execute on Outlook startup and mail events.

Malicious Shell Spawned by Windows Script Host (via process_creation)

This rule detects wscript or cscript spawning PowerShell, cmd or another script host, the staging behavior Gootloader and SocGholish use when a first-stage JScript file launches a second stage. A script host launching a shell is an execution technique tracked in the Red Canary Threat Detection Report. Detecting this parent-child pair surfaces script-based malware progressing to its next stage.

Suspicious Windows Defender Exclusion for PowerShell via Add-MpPreference (via process_creation)

This rule detects the AsyncRAT loader disabling Microsoft Defender coverage by adding process and path exclusions through Add-MpPreference. The campaign excludes the entire C drive and the powershell.exe process to protect its staged payloads. Adding a scripting host as a Defender exclusion is rarely legitimate.

Suspicious Renamed Pythonw Interpreter Execution via XWorm Loader (via process_creation)

This rule detects execution of the pythonw interpreter that has been renamed away from its original filename, a masquerading technique used by an XWorm loader that ships pythonw as pw.exe to run obfuscated Python payloads.

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

This rule detects qemu-system emulator processes started with a user-mode network device that connects to a remote socket while running headless. Actors abuse QEMU by launching it with -netdev user socket connect to a remote host and -nographic to build a covert tunnel out of an environment, so this command line indicates network tunneling through a legitimate virtualization binary rather than normal VM use.

Suspicious AutoIt Execution from PIF File Masquerade

This rule detects an AutoIt interpreter running with a pif extension image such as Flour.pif from a user writable location. This masquerade delivered an RC4 decrypted Vidar Stealer payload in the KMSPico drive-by chain. Renaming the AutoIt engine to a pif hides script based execution from casual review.

Suspicious China Chopper Web Shell in Temporary ASP.NET Files

This rule detects compiled App_Web assemblies written into the Temporary ASP.NET Files directory, the artifact left when Tropic Trooper's China Chopper web shell embedded in an Umbraco page is compiled by IIS. While ASP.NET compiles legitimate pages here too, unexpected App_Web DLLs on a static or CMS server warrant review for web shell activity.

Suspicious Svchost Executed From Outside System32

This rule detects the svchost.exe image executing from a directory other than the Windows system folders as seen when the persistent actor ran a masqueraded svchost from ProgramData and this matters because the genuine service host always launches from System32 or SysWOW64 so any other path is a reliable masquerading indicator.

Enabling RDP service via reg.exe command execution

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Suspicious WhatsAppBackup Data Staging Archive Creation

This rule detects creation of a WhatsAppData.zip archive inside a WhatsAppBackup directory on the system drive. Silver Fox drops a Python stealer that collects victim data into this fixed staging path before exfiltration. A backup themed archive assembled at this hardcoded location signals collection ahead of data theft.

Malicious TEARPAGE wtsapi32.dll Side-Load via BdeUISrv by UNC2970 (via image_load)

This rule detects the BitLocker helper BdeUISrv.exe loading wtsapi32.dll from outside the System32 directory, the DLL search-order hijack UNC2970 used to side-load the TEARPAGE loader. A signed system binary loading a system-named DLL from an unexpected path is a strong side-loading indicator.

Malicious NotDoor Outlook Macro Auto-Execution Enablement via Registry (via registry_set)

This rule detects registry modifications that make Outlook load a macro provider on boot and lower Outlook macro security, a persistence and defense evasion technique used by the NotDoor backdoor. Legitimate software rarely enables LoadMacroProviderOnBoot together with a relaxed macro security level.

Masquerading Kimsuky Troll Stealer Scheduled Task Deletion of ChromeUpdateTaskMachineUAC via schtasks (via process_creation)

This rule detects deletion of the scheduled task named ChromeUpdateTaskMachineUAC through schtasks, a cleanup behavior the Troll Stealer dropper used by Kimsuky performs to remove a masquerading update task after execution. Removing a disguised task named after a browser updater is an uncommon defense-evasion action tied to this intrusion, making it a useful post-compromise signal.

Malicious Regsvr32 Scriptlet or Remote COM Object Execution (via process_creation)

This rule detects regsvr32.exe registering a scriptlet through scrobj.dll or loading a COM object from a remote URL, the "Squiblydoo" proxy-execution pattern. Regsvr32 is a recurring System Binary Proxy Execution technique in the Red Canary Threat Detection Report, abused to run attacker script code under a signed Microsoft binary while bypassing application allowlisting. Detecting the scrobj and remote-URL invocations flags the evasion.