Sigma detection rules, expert-reviewed

Malicious Boot Recovery Disabled via Bcdedit (via process_creation)

This rule detects bcdedit disabling boot recovery or ignoring boot failures, an inhibit-recovery step performed by the Rorschach ransomware before encryption. Tampering with the boot configuration to block Windows recovery is a hallmark of ransomware preparing to deny system restoration.

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

This rule detects the .NET AppLaunch.exe utility being spawned as a standalone process, the hollowing target Rhadamanthys injects its stealer payload into. AppLaunch is rarely launched directly outside of a Visual Studio debugging context, so its creation by non-developer parents suggests process injection.

Malicious Regsvr32 ShellExec_RunDLL Proxy Execution (via process_creation)

This rule detects regsvr32 invoking shell32.dll ShellExec_RunDLL with the unregister and silent flags, a proxy execution trick used by Raspberry Robin to run commands through a trusted binary. This LOLBIN pattern is used to evade application controls and is not produced by normal component registration.

Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)

This rule detects creation of a scheduled task with a minute-based recurrence whose action launches PowerShell, the persistence and beaconing mechanism used by the TinyNote backdoor of Camaro Dragon. High-frequency scheduled tasks driving PowerShell are unusual for legitimate software and typically indicate implant callbacks.

Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)

This rule detects wscript or cscript launching PowerShell with an Invoke-Expression payload, the VBScript to PowerShell IEX chain used by GuLoader to deliver malware. A Windows script host spawning PowerShell to evaluate a downloaded string is a common in-memory execution pattern rarely produced by legitimate automation.

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

This rule detects the RoboForm helper binaries robotaskbaricon.exe or passwordgenerator.exe running from outside their normal install location, the DLL sideloading vector used to load a malicious RoboForm.dll in the SmugX campaign. A trusted signed name executing from a wrong path is a classic sideloading indicator.

Suspicious Plink SSH Tunnel Execution (via process_creation)

This rule detects the Plink command line SSH client being launched with port forwarding flags, a tunneling technique used by the Agrius group to proxy traffic and reach internal systems. Adversaries abuse Plink to create covert channels through perimeter defenses, which is rarely benign on endpoints.

Malicious LSASS Credential Dump via ProcDump (via process_creation)

This rule detects ProcDump being used to create a full memory dump of the LSASS process, a credential access technique observed in the Agrius MoneyBird intrusions against Israeli organizations. Adversaries dump LSASS to harvest cached credentials and enable lateral movement, so this activity strongly indicates hands-on-keyboard compromise.

Possible Remcos C2 Connection from eilowutil Process

This rule detects outbound connections from eilowutil.exe to TCP port 7060, matching the injected Remcos process and non standard C2 port in the GuLoader campaign. A process injected via GuLoader beacons out over an uncommon high port to the Remcos controller. Detecting it exposes established command and control on the host.

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

This rule detects loading of dal_keepalives.dll, a uniquely named malicious module sideloaded through signed binaries in the Stayin Alive campaign against telecoms and government ministries in Asia. The specific DLL name is a distinctive loader artifact with no legitimate use.

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

This rule detects a DLL being loaded from a directory named Z-1-36-81, the fixed staging folder CoinLoader uses for DLL sideloading. This distinctive directory constant is an artifact of the loader and is not associated with any legitimate software distribution.

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

This rule detects the Cortex XDR component cy.exe loading a winutils.dll module, the DLL sideloading chain the Rorschach ransomware abuses to decrypt and inject its payload. Leveraging a trusted security tool to sideload a malicious DLL is a stealthy loading technique unlikely to appear in benign telemetry.

Malicious Storm-2603 Ransom Note File Creation

This rule detects the creation of the ransom note file 'How to decrypt my data.txt' dropped by Storm-2603 ransomware payloads. Appearance of this file across user directories signals that file encryption has already executed on the host and the operator is presenting extortion instructions to the victim.

Suspicious WezRat Keylog File in Temp Directory

This rule detects creation of the fixed keylog output file 10105060.txt in the user Temp directory used by the WezRat backdoor. The malware records captured keystrokes to this static filename before exfiltration. Detecting the artifact confirms keylogging activity on the host.

Suspicious BugSleep Marker File in Public Directory

This rule detects creation of a file named a.txt in the C-Users-Public directory, an existence marker used by the BugSleep backdoor during its injection routine. The malware writes and checks this public path artifact to coordinate its shellcode injection into browser and remote access processes. Detecting the marker can surface the backdoor on the host.