Sigma detection rules, expert-reviewed

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

This rule detects PowerShell launched with a hidden window together with an unrestricted execution policy and the no-profile flag, the launch pattern used by the LummaStealer 2.0 ClickFix lure to run its downloader stage. Attackers combine these flags to suppress user visibility and bypass script restrictions, so the combination is a strong signal of scripted malware delivery.

Shadow Copy Deletion via Vssadmin to Inhibit Recovery

This rule detects vssadmin.exe deleting all volume shadow copies quietly, the recovery-inhibition step performed by PlayBoy Locker before encryption. Removing shadow copies prevents victims from restoring files and is a defining precursor to ransomware detonation.

Masqueraded Executable With Double Image Extension

This rule detects execution of files carrying a double extension that hides an executable behind an image name such as .jpg.scr, a masquerading trick used by the Phorpiex downloader payloads. Double extensions deceive users and analysts into treating a runnable file as a harmless image.

AutoIt Script Execution via A3X Payload

This rule detects execution of a compiled AutoIt script through the AutoIt3ExecuteScript switch with an .a3x payload, seen in the Andromeda Gamarue cluster running via a masqueraded GoogleChrome.exe. Abusing the AutoIt interpreter to run a3x scripts is a common malware execution and obfuscation technique.

Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal

This rule detects rundll32.exe invoking a DLL export _ldr together with a desktop.ini argument, the loader launch pattern of the Andromeda Gamarue cluster. Using rundll32 to call an obscure loader ordinal while referencing desktop.ini is a distinctive execution and evasion behavior.

Service Hiding via SC Sdset Security Descriptor Modification

This rule detects sc.exe using sdset to rewrite a service security descriptor, a technique used in Cuckoo Spear to hide the NOOPDOOR service from enumeration and deletion. Manipulating service DACLs to deny access is a persistence-hardening and defense-evasion behavior.

Inbound C2 Firewall Rule Added via Netsh for TCP 5984

This rule detects netsh.exe adding a firewall rule opening TCP port 5984, the inbound access hole created by NOOPDOOR operators in Cuckoo Spear. Opening a specific high port via netsh to permit attacker connections is an evasion and command-and-control enablement step.

Proxy Execution via MSBuild Running Inline Task XML

This rule detects msbuild.exe executing a standalone .xml project file, the NOOPLDR loading technique used in Cuckoo Spear to run inline C# tasks and evade application control. MSBuild consuming a loose XML file rather than a solution or project is a common trusted-developer-utility abuse pattern.

Scheduled Task Masquerading as Microsoft Wininet Config

This rule detects schtasks.exe creating a task under a Microsoft Windows Wininet Config path, a non-existent Microsoft task tree used by DeadRinger actors to disguise persistence. Placing tasks in a fake Microsoft folder helps them blend with legitimate scheduled tasks.

Active Directory Database Dump via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media snapshot to dump the ntds.dit Active Directory database, a domain credential theft step observed in the DeadRinger campaign against telcos. Extracting ntds.dit yields every domain account hash and is a high-impact credential access technique.

Lateral Movement via WMIC Remote Process Creation

This rule detects wmic.exe invoking process call create against a remote node, the technique used in Operation Soft Cell to execute batch payloads across telecom networks. Remote WMI process creation is a common lateral movement and execution vector for hands-on-keyboard operators.

Data Collection via Rar Archiving With Recursion and Compression Flags

This rule detects command-line RAR archiving using recursive and compression flags seen in Operation Soft Cell staging of stolen data for exfiltration. Bulk recursive archiving prior to exfiltration is a common collection step and warrants review when combined with the observed flag pattern.

Credential Dumping via Reg Save of SAM Hive

This rule detects reg.exe saving the HKLM SAM registry hive to disk, an offline credential extraction step observed in Operation Soft Cell. Exporting the SAM hive lets attackers crack local account hashes away from the endpoint.

Suspicious Credential Dump via lsa.exe Debug Output

This rule detects execution of an lsa.exe tool with debug and module switches writing to a debug.bin file, the credential-dumping utility used in Operation GhostShell. Attackers run this to extract secrets from LSASS-related material and stage them for exfiltration. The specific command-line switches and output filename make this a distinctive credential-theft indicator.

Suspicious WinRM Compatibility HTTPS Listener Enabled via winrm.vbs

This rule detects use of winrm.vbs to enable the compatibility HTTPS listener, a remote-service configuration change used by Winnti in Operation CuckooBees to establish encrypted WinRM access. Attackers enable this listener to move laterally and control hosts over an encrypted management channel. Enabling the WinRM compatibility HTTPS listener via the script host is an uncommon and suspicious remote-access setup.