Sigma detection rules, expert-reviewed

Malicious TALONITE GUP.exe Proxy Masquerading as Notepad++ Updater (via process_creation)

This rule detects execution of GUP.exe from any location outside the legitimate Notepad++ installation directory. TALONITE deploys a malicious proxy binary named GUP.exe to impersonate the genuine Notepad++ updater and blend into normal host activity. A GUP.exe running from a user, temp, or unexpected path indicates a masquerading C2 proxy rather than the real updater.

Suspicious Instant Messenger Client Spawning Script Interpreter (via process_creation)

This rule detects Discord or Telegram desktop clients spawning command shells and scripting interpreters as child processes. Adversaries abuse instant messaging platforms for command and control, using the legitimate client as a launch point for follow-on execution. A messaging application spawning cmd, PowerShell, or scripting hosts is anomalous and indicates malicious tooling masquerading as chat software.

Malicious VOLTZITE Netsh Portproxy Port Forwarding via Command Line (via process_creation)

This rule detects use of netsh.exe to create an interface portproxy rule that forwards network traffic between hosts. VOLTZITE leverages this native binary to relay traffic and pivot deeper into critical infrastructure networks. Attackers rely on portproxy forwarding to tunnel access through compromised systems while evading network segmentation controls.

Suspicious EKANS Ransomware Payload Dropped to Drive Root (via file_event)

This rule detects creation of the file update.exe directly in the root of the C drive, a staging behavior of EKANS ransomware prior to encryption of ICS environments. EKANS drops its payload and ransom note to the drive root and user desktop before terminating industrial and database processes. Writing an executable named update.exe to the drive root is highly unusual and warrants immediate investigation.

Suspicious PowerShell Script Fetching Remote Batch File From Paste Site (via ps_script)

This rule detects PowerShell script blocks that reference a paste site alongside a batch file extension, matching the download-and-execute behavior in Deep Instinct's Regex Gone Rogue analysis. The macro-launched PowerShell retrieves and runs a .bat file hosted on Pastebin. This indicates staged remote payload delivery and execution through a living-off-the-land interpreter.

Suspicious PowerShell Download of Payload From Pastebin (via process_creation)

This rule detects PowerShell invoked with a command line referencing pastebin.com, the delivery channel described in Deep Instinct's Regex Gone Rogue analysis where an Excel macro fetches a batch payload from Pastebin. Attackers stage second-stage scripts on paste sites to evade domain reputation controls. This indicates remote payload retrieval during the execution stage.

Possible DCOM MSI Install Server Execution via Msiexec Embedding (via process_creation)

This rule detects msiexec.exe launched with the -Embedding switch as a child of the DCOM launcher service, the execution pattern abused by the DCOM Upload and Execute backdoor described by Deep Instinct. Attackers invoke the MSI install server DCOM object remotely to run code without PsExec-style services. This can indicate lateral movement over DCOM using a signed Windows binary.

Suspicious Scheduled Task Masquerading as Office Update via Process Creation

This rule detects creation of a scheduled task named Office Automatic Updates 2.0 by a parent other than the legitimate OfficeClickToRun updater, the SYSTEM-level persistence disguise used in the SHIM Me What You Got technique. Adversaries mimic a trusted Office task name to blend malicious persistence with routine update tasks.

Malicious DLL Injection via Mavinject Process Creation

This rule detects mavinject being used with the INJECTRUNNING option to inject a DLL into a running process, the injection primitive abused in the SHIM Me What You Got technique. Outside of App-V, this signed living-off-the-land binary is rarely used, making the injection flag a strong malicious indicator.

Malicious Shadow Copy Deletion and Boot Recovery Tampering via Process Creation

This rule detects deletion of volume shadow copies via vssadmin or removal of the safeboot boot configuration value via bcdedit, the recovery-inhibition steps BlackSuit ransomware runs before encryption. Adversaries destroy backups and disable safe-mode recovery to maximize impact and hinder restoration.

Malicious BlackSuit Ransomware Execution via Process Creation

This rule detects the distinctive command-line flags of BlackSuit ransomware combining virtual machine termination, full-file encryption, and a victim identifier. This flag combination is unique to the BlackSuit encryptor and signals an active encryption run.

Malicious Regsvr32 Loading Masqueraded VPN DLL via Process Creation

This rule detects regsvr32.exe registering a DLL named vpn.sessings, a Cobalt Strike loader masquerading as a Cisco AnyConnect component in the Uncorking Old Wine campaign. Adversaries proxy DLL execution through regsvr32 with a benign-looking VPN filename to evade application controls.

Possible Atera or Tactical RMM Agent Execution via Process Creation

This rule detects execution of the Atera or Tactical RMM agents, remote management tools MuddyWater abused in the DarkBeatC2 campaign for persistent operator access. Because these agents are also used by legitimate IT teams, unexpected installs on non-managed hosts should be validated.

Suspicious PowerShell Interaction with ProgramData SysInt Log via Process Creation

This rule detects PowerShell reading or writing the C ProgramData SysInt.log file that MuddyWater's DarkBeatC2 uses as a staging and command buffer in its multi-stage poll loop. The specific ProgramData filename combined with PowerShell indicates the DarkBeatC2 implant rather than legitimate logging.

Suspicious Child Process Spawned by WinRAR via Process Creation

This rule detects WinRAR spawning a command interpreter or script host, the exploitation pattern of CVE-2023-38831 in which a trailing-space filename trick causes WinRAR to execute an attacker .cmd, as leveraged by UAC-0099 against Ukrainian targets. Such child processes indicate archive-borne code execution rather than normal extraction.