Sigma detection rules, expert-reviewed

Suspicious PowerShell Communication with Dropbox API (via ps_script)

This rule detects PowerShell script content that contacts the Dropbox content API file download endpoint. The DEEP#GOSU campaign abused Dropbox as a staging and exfiltration channel for encrypted payloads and stolen data.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Suspicious Download Cradle via Cmd Mkdir and Curl in Process Creation

This rule detects a cmd.exe one-liner that creates a Temp working directory and immediately downloads a payload with curl, a staging cradle observed ahead of remote access tool deployment. Attackers combine directory creation and a follow-on curl fetch to retrieve installers into a predictable path, so this chained command indicates payload retrieval and staging.

Suspicious PowerShell Bypass Spawned by wscript Script Host

This rule detects wscript spawning PowerShell with an execution policy bypass, the initial handoff in a Huntress-analyzed malspam-to-loader chain that led to an in-memory .NET loader. A script host launching PowerShell with bypass flags reflects a scripted download-and-execute stage rather than normal administration. This parent-child pattern is a common malspam loader behavior.

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

This rule detects creation of ZIP archives whose file name is a single letter or digit, a staging convention observed in VOLTZITE intrusions. The group compresses collected data into minimally named archives to blend into disk activity before exfiltration. Detecting these staging files provides an opportunity to interrupt data theft prior to transfer.

Malicious regsvr32.exe Spawned by calc.exe via DLL Side-Loading

This rule detects regsvr32.exe launched with the Windows Calculator calc.exe as its parent process. During Qbot infections the side-loaded calc.exe uses regsvr32 to register and execute the trojan payload DLL. Calculator legitimately never spawns regsvr32, so this parent-child chain is a strong indicator of DLL side-loading and proxied code execution.

Malicious LSASS Credential Dump via comsvcs.dll MiniDump by APT28 (via process_creation)

This rule detects use of rundll32 to invoke the MiniDump export of comsvcs.dll against the LSASS process, the credential-access technique documented in CERT-FR analysis of the APT28 intrusion set targeting French entities. Adversaries leverage this signed LOLBin to capture a memory dump containing plaintext and hashed credentials, making early detection critical for stopping privilege escalation and lateral movement.

In-Memory MSBuild Proxy Execution of a Project From a User-Writable Path (via process_creation)

This rule detects MSBuild.exe building an inline-task project file located in a user, temp or AppData directory, a pattern adversaries use to compile and run C# payloads in memory under a signed Microsoft developer utility. MSBuild proxy execution is a trusted-developer-utility abuse technique in the Red Canary Threat Detection Report. Detecting builds sourced from user-writable paths surfaces code execution that evades application allowlisting.

Malicious Recovery Inhibition via Shadow Copy and WinRE Tampering

This rule detects command lines that delete Volume Shadow Copies with vssadmin or disable the Windows Recovery Environment with reagentc, actions used by NOVABLIGHT to prevent system and file recovery. Inhibiting recovery is a common precursor to destructive or extortion activity.

Suspicious Disk Image File Written by a Browser or Mail Client (via file_event)

This rule detects a browser or email client writing an ISO, IMG or VHD disk-image file to disk, the delivery half of an HTML-smuggling campaign that packages a payload inside a container to bypass Mark-of-the-Web and mail-attachment controls. HTML smuggling and container-file delivery are recurring initial-access techniques in the Red Canary Threat Detection Report. Detecting image files dropped by internet-facing apps surfaces smuggled payloads before they are mounted and run.

Suspicious Batch Script Unhiding Files via Attrib From Temp

This rule detects a batch script spawning attrib.exe to clear hidden and system attributes, a staging step used by Zhong Stealer to reveal and execute dropped components. Clearing attributes on files via a randomly named batch is uncommon in benign activity.

Suspicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion via Add-MpPreference. The SonicCrypt crypter behind TA585 MonsterV2 deliveries added its payload to Defender exclusions to evade scanning.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - PowerShell (via powershell)

This rule detects change Defender default action to allow any threats.

Suspicious Ahnenblatt Application Execution From User-Writable Directory

This rule detects the legitimate Ahnenblatt genealogy application Ahnenblatt4.exe running from a Temp or AppData directory. In the RenEngine campaign this signed application was abused as a DLL side-loading host by dropping it next to malicious borlndmm.dll and cc32290mt.dll to launch HijackLoader as reported by Kaspersky. Execution of this uncommon application from a user-writable path signals a DLL search-order hijack rather than normal use.

WWLIB DLL Sideloading via WinWord Outside Office Directory in KamiKakaBot Chain (via image_load)

This rule detects WinWord.exe loading WWLIB.dll from a path outside the legitimate Microsoft Office installation directory, the DLL sideloading pair used by KamiKakaBot when a masqueraded Office binary is executed from an ISO or temporary folder. Adversaries leverage this sideload to run malicious code under a trusted Office process, making detection valuable for catching the initial execution stage.