Sigma detection rules, expert-reviewed

WWLIB DLL Sideloading via WinWord Outside Office Directory in KamiKakaBot Chain (via image_load)

This rule detects WinWord.exe loading WWLIB.dll from a path outside the legitimate Microsoft Office installation directory, the DLL sideloading pair used by KamiKakaBot when a masqueraded Office binary is executed from an ISO or temporary folder. Adversaries leverage this sideload to run malicious code under a trusted Office process, making detection valuable for catching the initial execution stage.

Suspicious Local Account Creation via Net User

This rule detects local account creation using the net user add command which the REF0657 actors used to add a helpdesk account through a malicious service for persistent access. Interactive account creation may be legitimate for administrators so this activity should be corroborated with the creating context.

Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)

Alerts when curl is run on Windows with --ntlm and empty -u : credentials, a pattern that may leak the current user's NTLMv2 response.

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

This rule detects use of wevtutil to disable the Security and Application event log channels, a defense-evasion action performed by FunkSec ransomware to blind logging before encryption. Adversaries turn off event channels so their tampering, service termination and encryption activity is not recorded for responders.

Obfuscated Fickle Stealer Injection Path Store prepares.dat Under Public (via file_event)

This rule detects creation of prepares.dat in the public users directory, the file where Fickle Stealer stores base64-encoded paths of injected components for its multi-stage execution. Adversaries leverage this world-writable location to persist loader state, making detection of the fixed filename and path a useful indicator of an active Fickle infection.

Suspicious Cached Logon Disable via Winlogon CachedLogonsCount (via registry_set)

This rule detects modification of the Winlogon CachedLogonsCount value, which the Lotus Wiper sets to zero to remove cached domain credentials and hinder recovery. Disabling cached logons contributes to the destructive impact of the wiper against energy and utilities targets. Detecting this rare registry change highlights defense weakening prior to disk destruction.

Suspicious Certutil URLCache Download

This rule detects certutil.exe used with the urlcache option to download a remote file. The DragonRank SEO-poisoning operators abused certutil urlcache to pull additional tooling onto compromised IIS servers. Certutil functioning as a downloader is a living-off-the-land ingress technique that evades controls expecting a browser or dedicated transfer tool.

Suspicious DarkGate Cleanup Batch Execution

This rule detects execution referencing DarkGate working artifacts under the C temp tskm folder used to store the id.txt bot identifier. DarkGate stages its runtime files and identifier in this fixed location, so command lines touching it indicate the loader is active.

Suspicious SOAPHound Tautological LDAP Filter Enumeration

This rule detects Directory Service event 1644 LDAP queries using the tautological filter (!(FALSE)) which matches every object, a signature of SOAPHound style collection that pulls the full directory in bulk. The always-true filter combined with the SD_FLAGS 0x7 control lets the tool harvest all objects and their security descriptors efficiently. A directory-wide (!(FALSE)) query is a strong indicator of automated Active Directory reconnaissance.

Malicious Impacket-Style Remote Command Execution Pattern (via process_creation)

This rule detects the command shell pattern used by Impacket remote-execution tools such as wmiexec, smbexec and atexec, where cmd.exe runs a command and redirects its output to a local admin share or loopback path (for example 1> \\127.0.0.1\ADMIN$). Remote execution over SMB/WMI is a lateral-movement behavior featured in the Red Canary Threat Detection Report and is heavily used by hands-on-keyboard operators. Detecting this redirect-to-share signature surfaces Impacket-driven lateral movement.

Suspicious Account Disable via net user active no (via process_creation)

This rule detects net.exe disabling a user account with the active no flag, an action the Lotus Wiper performs to remove account access and deny defenders control of affected hosts. Disabling accounts supports the wiper goal of locking users out during a destructive campaign. Detecting this command surfaces account access removal activity.

Suspicious sshd.exe Outbound Connection over SMB Port (via network_connection)

This rule detects the OpenSSH server binary sshd.exe communicating over TCP port 445, an anomalous pairing Stately Taurus used to tunnel SSH sessions across the SMB port to bypass firewall egress restrictions. Running an SSH daemon over the SMB port disguises interactive remote access as normal file-sharing traffic.

Suspicious Network Provider Registration for Credential Interception via NPPSpy

This rule detects the registration of a network provider ProviderPath value under the service control set, the mechanism NPPSpy uses to capture plaintext logon credentials during interactive sign-in as seen in Operation Diplomatic Specter. A rogue network provider silently harvests domain credentials as users authenticate. Detecting this registration exposes credential-access tradecraft on the host.

Suspicious Script Host Executing VBS from ConnectWiseControl Temp Directory

This rule detects wscript or cscript executing a VBScript dropped under Documents ConnectWiseControl Temp, the staging path used by PhantomControl to run Ande Loader after ScreenConnect delivery. Abusing a remote support tool folder lets attackers stage and run malicious scripts while appearing to be legitimate support automation.

Suspicious External IP Lookup to ipify Service (via dns_query)

This rule detects DNS resolution of the ipify external IP-lookup service, which adversaries query at the start of instant-messaging command and control to discover the victim public address. Malware pairs this lookup with sessions to Discord or Telegram APIs to fingerprint the environment before beaconing. The lookup is dual-use, so correlate with unsigned or masquerading binaries for higher confidence.