Sigma detection rules, expert-reviewed

Suspicious Execution from Hidden Diagnostic Directory via Process Creation

This rule detects execution of binaries from a hidden directory named .end or of the Diagnostic.exe and Windows.Diagnostic.Document.EXE loaders used in the MuddyWater eN-Able chain launched from an LNK attachment. Adversaries hide payloads in dot-prefixed folders and use benign-looking diagnostic filenames to evade casual inspection while a decoy window distracts the user.

Possible Remote Monitoring and Management Tool Execution via Process Creation

This rule detects execution of the SimpleHelp or Advanced Monitoring Agent remote management tools, which MuddyWater deployed in the eN-Able spear-phishing operation to gain hands-on-keyboard control of victim hosts. Adversaries abuse legitimate RMM software for stealthy remote access that survives endpoint controls, so unexpected installs warrant review.

Suspicious Scheduled Task Creation from XML Definition via Process Creation

This rule detects creation of a scheduled task from an external XML definition file via schtasks.exe, the persistence mechanism used by Operation Rusty Flag to keep its Rust implant resident. Adversaries stage task XML on disk to register persistence with fine-grained triggers while blending with legitimate task provisioning.

Suspicious BlackSuit Ransomware Note and Encrypted File Artifacts via File Event

This rule detects creation of the readme.blacksuit.txt ransom note or files renamed with the .blacksuit extension, the on-disk artifacts left by BlackSuit ransomware during encryption. Their appearance across a host or share indicates an in-progress or completed encryption event.

Possible C2 Beacon to Dynamic DNS Provider via DNS Query

This rule detects DNS resolution of dynamic-DNS domains under ddns.net, serveirc.com, and hopto.org, the fast-flux infrastructure MuddyWater used for MuddyC2Go beacons. Adversaries favor dynamic DNS to rotate C2 endpoints cheaply, so resolutions to these providers from server or non-consumer hosts merit correlation with process activity.

Malicious axios NPM Supply Chain Persistence via MicrosoftUpdate Run Key

This rule detects creation of a Run key value named MicrosoftUpdate under the Windows CurrentVersion Run path, a persistence mechanism dropped by the trojanized axios npm packages through their postinstall setup.js script. The masquerading value name mimics a legitimate Microsoft update task while pointing to attacker second-stage code that beacons to sfrclak.com. Detecting this key is important because it establishes reboot-persistent execution of supply-chain malware on developer hosts.

Malicious Registry Run Key Persistence Masquerading as MicrosoftUpdate

This rule detects creation of a HKCU Run value named MicrosoftUpdate, a masquerading persistence name planted by the compromised axios npm package RAT. The malware writes this autorun entry to relaunch a dropped script at logon while posing as a legitimate Microsoft component. A user-hive Run key using this Microsoft-lookalike name is a strong persistence indicator for this supply chain RAT.

Malicious Node.js Execution of Hidden .claude Setup Script

This rule detects Node.js executing a setup script from a hidden .claude directory, the auto-run payload delivered by the open source Shai-Hulud framework. A workspace tasks.json configured to run on folder open silently launches this script when a developer opens the repository. Node running a hidden .claude setup module is not part of normal project execution and marks the initial foothold.

Suspicious Node.js Spawning Script Interpreter for Dropped Payload

This rule detects a Node.js process launching the Windows script host or a Python interpreter against a payload staged in the temp directory, the dropper chain of the compromised axios package RAT. The malicious postinstall script writes a VBS or Python loader to a temp location and executes it to establish the cross-platform RAT. Node spawning wscript or python on a temp script is anomalous for normal package installs.

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

This rule detects a PowerShell command that downloads a file with Invoke-WebRequest and then runs it with Start-Process which the MUT-8694 campaign chains inside malicious npm and PyPI packages to fetch and launch a second stage on Windows hosts.

Malicious Microsoft Defender Tampering via PowerShell Preference Cmdlets

This rule detects the use of Add-MpPreference or Set-MpPreference to add scan exclusions or disable real time protection which the MUT-8694 npm and PyPI campaign runs to blind Microsoft Defender before deploying its payloads on Windows developer systems.

Malicious DLL Execution With Non Standard Extension via rundll32

This rule detects rundll32.exe loading a library renamed with a .db extension which the DPRK aligned Stressed Pungsan npm campaign uses to masquerade its downloaded payload package.db and execute an exported function while evading extension based detection.

Malicious axios NPM Supply Chain C2 Domain Resolution

This rule detects DNS resolution of sfrclak.com, the command-and-control domain contacted by the trojanized axios and plain-crypto-js npm packages after their postinstall scripts execute. The malware sends base64-encoded JSON beacons over HTTP to this host roughly every 60 seconds to fetch second-stage per-OS payloads. Detecting the lookup is important because it surfaces build and developer machines compromised through the npm supply chain.

Suspicious Scheduled Task Named WindowsHelper (via process_creation)

This rule detects schtasks creating a task named WindowsHelper. Operation HumanitarianBait registers this masqueraded task to relaunch its VBScript stager every few minutes for persistence.

Suspicious Wscript Spawning Embedded Python Interpreter (via process_creation)

This rule detects wscript.exe launching pythonw.exe, an unusual chain used by Operation HumanitarianBait. A VBScript launcher runs an embedded Python interpreter to execute the PyArmor-protected stealer module silently.