Sigma detection rules, expert-reviewed

Malicious Run Key Persistence Referencing DLL in User Documents

This rule detects a Run key persistence value whose data references a DLL located under a user Documents folder, matching the Rhadamanthys stealer persistence that pointed an autorun entry at a DLL in the Documents directory. Autorun entries loading a DLL from a user-writable location strongly indicate malicious persistence rather than legitimate software.

Windows Defender Disabled via DisableAntiSpyware Registry Key

This rule detects the Windows Defender DisableAntiSpyware registry value being set, an antivirus tampering step performed by the Phorpiex downloader before deploying LockBit. Disabling Defender via this policy key removes real-time protection prior to ransomware execution.

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

This rule detects modification of the ServiceDll value for the IKEEXT or PrintNotify services, a DLL search-order and service hijack technique used by Winnti in Operation CuckooBees for persistence. Attackers point these built-in services at a malicious DLL so their code runs under a trusted service context. Tampering with the ServiceDll of these services is a strong persistence-and-evasion indicator.

PlugX Persistence via Run Key Named AAM Updatevlm

This rule detects creation of an autorun Run key value named AAM Updatevlm, a masquerading persistence value used by PlugX in DLL side-loading intrusions. The value name imitates a legitimate Adobe updater to blend in while re-launching the side-loaded malware at logon.

Suspicious Access to Citrix Session Evidence Registry Keys

This rule detects modification of Citrix session Evidence registry keys that record ClientName and ClientIP, which attackers exploiting CitrixBleed (CVE-2023-4966) leverage to hijack authenticated sessions. Manipulating these keys helps the attacker impersonate legitimate remote sessions after stealing session tokens. Monitoring these keys surfaces session-hijack activity tied to the vulnerability.

Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest

This rule detects the Exchange management cmdlet New-MailboxExportRequest writing a mailbox export to an .aspx file, the technique used in the DatopLoader ProxyShell chain to drop a web shell onto the Exchange server. Exporting mailbox data to a web-accessible ASPX path is a hallmark of ProxyShell post-exploitation and web shell staging.

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

This rule detects PowerShell script content that combines Invoke-Expression with the -replace operator using mixed-case obfuscation, a deobfuscation-then-execute pattern used by GootLoader. Attackers scramble the payload string and reconstruct it at runtime to evade static detection before executing it in memory. The IEX plus -replace combination is a strong indicator of obfuscated in-memory execution.

Malicious Shell Spawned by SharePoint Worker Process w3wp

This rule detects the SharePoint worker process w3wp.exe spawning a command shell or PowerShell, the post-exploitation behavior following ToolShell webshell deployment. A web server worker launching interactive shells indicates webshell execution or exploitation of the hosting application.

Suspicious NetSupport client32 Execution from AppData

This rule detects the NetSupport client binary client32.exe executing from an AppData directory, the location where the ClickFix campaign deployed NetSupport as a RAT. Although NetSupport is legitimate remote-control software, execution from a user profile directory indicates abuse for unauthorized remote access.

Suspicious PowerShell Archive Extraction to AppData Roaming

This rule detects PowerShell expanding an archive into the AppData Roaming directory, the delivery step used by the WordPress ClickFix campaign to stage the NetSupport RAT. Extraction of archives into user-writable roaming locations by PowerShell is a common malware staging behavior.

Malicious Domain Group Enumeration via NetSupport remcmdstub

This rule detects the NetSupport remote command helper remcmdstub.exe spawning the net utility to enumerate domain groups, the Active Directory reconnaissance seen in the NetSupport RAT ClickFix campaign. A remote-control agent driving domain enumeration indicates hands-on-keyboard discovery by an operator.

Malicious Boot Configuration Set to Safe Mode with Networking via bcdedit

This rule detects bcdedit.exe configuring the system to boot into Safe Mode with Networking, an inhibit-recovery step used by Qilin ransomware to run its encryptor while defenses are inactive. Modifying boot configuration to force Safe Mode is a hallmark of ransomware preparing to encrypt with security tooling disabled.

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

This rule detects PowerShell spawned by a process named nvidia geforce experience.exe, a masquerade the Genesis Market campaign used to sideload LummaStealer from a legitimately named binary. The genuine GeForce Experience application does not launch PowerShell, so this chain indicates DLL sideloading and stealer execution.

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

This rule detects PowerShell launched with a hidden window together with an unrestricted execution policy and the no-profile flag, the launch pattern used by the LummaStealer 2.0 ClickFix lure to run its downloader stage. Attackers combine these flags to suppress user visibility and bypass script restrictions, so the combination is a strong signal of scripted malware delivery.

Shadow Copy Deletion via Vssadmin to Inhibit Recovery

This rule detects vssadmin.exe deleting all volume shadow copies quietly, the recovery-inhibition step performed by PlayBoy Locker before encryption. Removing shadow copies prevents victims from restoring files and is a defining precursor to ransomware detonation.