Sigma detection rules, expert-reviewed

Suspicious SYSTEM Scheduled Task Named test Created via schtasks

This rule detects creation of a scheduled task named test that runs as the SYSTEM account, an execution and lateral-movement pattern used by Winnti in Operation CuckooBees. Attackers register this high-privilege task to run payloads under SYSTEM, often against remote hosts. The generic task name combined with a SYSTEM run-as context is a distinctive Winnti indicator.

Malicious Registry Hive Dump via reg save

This rule detects reg.exe saving the SYSTEM, SAM, or SECURITY registry hives to disk, a credential-access technique used by Winnti in Operation CuckooBees to extract cached secrets and password hashes. Attackers export these hives for offline extraction of account credentials. Saving these particular hives is rarely legitimate outside backup tooling and strongly indicates credential theft.

Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument

This rule detects rundll32 loading a sqlite3 DLL by ordinal export #138 together with an x64.tlb argument, the loader invocation used by the Winnti arsenal in Operation CuckooBees. Attackers disguise the malicious payload as a legitimate sqlite3 library and pass a type-library file to trigger execution. This precise ordinal-and-tlb combination is a high-confidence Winnti loader indicator.

Suspicious Symlink Evaluation Enabled via fsutil

This rule detects fsutil being used to enable remote-to-local and local-to-remote symbolic link evaluation, a preparatory action BlackCat/ALPHV ransomware performs to reach and encrypt files across mounted and networked paths. Attackers enable this so encryption can follow symlinks to additional data. This uncommon fsutil configuration change is a distinctive BlackCat pre-encryption step.

Suspicious Scheduled Task Created by Windows Script Host

This rule detects a logon-triggered scheduled task being created by wscript.exe or cscript.exe, the persistence step in the GootLoader infection chain. Attackers register a script-host scheduled task so the loader re-executes at each user logon. A Windows Script Host process registering a scheduled task is uncommon and points to script-based persistence.

Suspicious PowerShell Spawned by cscript in Script Chain

This rule detects PowerShell being launched by cscript.exe, matching the GootLoader wscript to cscript to PowerShell execution chain. Attackers use this scripted lineage to stage the loader and pull down follow-on payloads while appearing script-driven. A Windows Script Host interpreter spawning PowerShell is a common malware-loader hand-off worth alerting on.

Suspicious vbc.exe Spawned by Installer Process

This rule detects the Visual Basic compiler vbc.exe being launched by a Setup or installer process, the injection host behavior of malware spread through cracked-software YouTube lures. Attackers hollow vbc.exe to run beaconing code that persists after the installer exits. A compiler binary spawned by an installer and used as a network beacon host is highly anomalous.

Suspicious PsExec Service Named Sliver

This rule detects PsExec lateral movement where the remote service is created with the name Sliver, a default artifact left by the Sliver C2 framework PsExec module. Attackers use this to move laterally and execute payloads under the SYSTEM account on remote hosts. The hardcoded service name is a high-confidence indicator of Sliver operator activity.

Suspicious Named Pipe Pipe2PortCtrl Created by Winnti Malware

This rule detects creation of the named pipe Pipe2PortCtrl, an internal communication channel used by Winnti malware components in Operation CuckooBees. Attackers use this hardcoded pipe for inter-module signaling and port-control coordination on the host. The specific pipe name is a distinctive artifact of the Winnti toolkit.

Suspicious msimg32.dll Loaded from Non-System Directory

This rule detects msimg32.dll being loaded from a location outside standard system directories, the search-order hijack Rhadamanthys used against a Haihaisoft PDF component to gain execution. Loading this common system DLL from an application or user directory is a reliable sign of DLL search-order hijacking.

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

This rule detects trusted signed executables side-loading helper DLLs commonly abused for DLL search-order hijacking such as GUP.exe loading libcurl.dll or MsMpEng.exe loading mpsvc.dll. This technique was widely abused by PlugX and related tooling to run malicious code under the guise of a legitimate signed process, and the rule filters the legitimate Windows Defender load path.

Malicious Madgicx Plus Chrome Extension Identifiers on Disk

This rule detects filesystem artifacts referencing the malicious Chrome extension identifiers distributed in the Madgicx Plus campaign for session-token theft. Presence of these specific extension IDs on disk indicates installation of the credential-stealing browser extension.

Cleo Autorun Exploitation via Healthcheck File Drop

This rule detects healthcheck.txt or healthchecktemplate.txt files written into a Cleo autorun directory, the file drop that triggers command execution when exploiting CVE-2024-55956. Placing these files in the monitored autorun folder causes Cleo software to execute attacker Bash or PowerShell commands.

Malicious Madgicx Plus Extension C2 Domain Resolution

This rule detects DNS resolution of the madgicx-plus.com command-and-control domain used by the Madgicx Plus malicious Chrome extension campaign to receive stolen session tokens. Resolution of this attacker-controlled domain from an endpoint indicates a compromised browser exfiltrating authentication material.

Suspicious Microsoft Office Test Persistence Key Creation (via registry_set)

This rule detects creation or modification of the Office test Special Perf registry value which forces Microsoft Office applications to load an arbitrary DLL at startup. This rarely used key gives adversaries stealthy persistence through trusted Office processes.