Sigma detection rules, expert-reviewed

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

This rule detects PikaBot post injection reconnaissance where a hollowed SearchProtocolHost.exe process spawns native discovery utilities such as whoami, ipconfig and netstat. PikaBot injects into SearchProtocolHost.exe using indirect syscalls before enumerating the host and network. The Windows indexing host does not legitimately launch these recon tools, so this parent child pairing is a high confidence indicator of injected loader activity.

Exchange WebShell Creation

These commands were used to create a WebShell by exploiting ProxyShell vulnerabilities

Suspicious sslconf Execution From AppData EdgeUpdate Directory

This rule detects a process named sslconf.exe running from a user AppData EdgeUpdate\Install path, matching the SectopRAT payload staged by the FakeAgent Claude Desktop malvertising campaign. The binary masquerades under an EdgeUpdate directory name in a user-writable location that legitimate Edge updater components never use. Execution from this wrong context indicates malware persistence and RAT activity.

Mshta Spawning PowerShell or Command Shell

This rule detects mshta.exe spawning powershell.exe or cmd.exe as a child process. YoroTrooper used an HTA to JScript to PowerShell execution chain to run reverse shells and stage further tooling. Mshta launching a scripting interpreter is a classic proxy-execution and living-off-the-land pattern used to evade application controls.

Suspicious Remote Thread Injection into Task Manager

This rule detects a remote thread being created in taskmgr.exe, an injection target used by the defendnot tool to host its fake antivirus registration DLL as analyzed by Huntress. Attackers inject into a signed system process to persist Security Center manipulation and evade scrutiny. Remote thread creation into Task Manager is unusual and indicates process injection for defense evasion.

Suspicious SMTP Submission Connection From Non-Mail Process

This rule detects an outbound connection to TCP port 587 (SMTP submission) initiated by a process that is not a known mail client. This behavior matches .NET infostealers such as Agent Tesla and XLoader that were hidden in bitmap resources and exfiltrate stolen credentials directly over SMTP. Direct SMTP use by arbitrary binaries is a strong data-theft indicator.

Suspicious Scheduled Task Executing DeElevate64

This rule detects a scheduled task configured via schtasks to run DeElevate64.exe. This behavior matches Ivanti CVE-2025-0282 intrusions where attackers established persistence and privilege manipulation through a scheduled task launching this binary. Scheduled tasks referencing uncommon named binaries are a persistence indicator warranting review of the task action and origin.

Suspicious Dism Execution from ProgramData Directory (via process_creation)

This rule detects execution of Dism.exe from the ProgramData directory rather than its legitimate System32 location. The FLUX#CONSOLE campaign copied Dism there to sideload a malicious DismCore.dll via search order hijacking.

Suspicious Persistence via Windows NT CurrentVersion Windows Load Value (via registry_set)

This rule detects Confucius writing to the legacy Windows load value under the HKCU Windows NT CurrentVersion Windows key which auto starts the copied Swom.exe loader at logon. The load value is an uncommon and abused autostart location. Any modification pointing to an executable is suspicious.

Suspicious Cloud Instance Metadata Service Probing

This rule detects command-line access to the cloud instance metadata endpoint at 169.254.169.254, used to steal instance credentials and role tokens. It is associated with software supply chain attacks whose payloads probe the metadata service from compromised build and developer environments. Detecting this probe surfaces cloud credential theft attempts early.

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

This rule detects rundll32.exe invoking COLDCOPY DLLs by their known filenames or by the humanCheck and verifyme export names used in COLDRIVER ClickFix lures. Attackers run these exports to launch the YESROBOT and MAYBEROBOT backdoors after tricking a user into pasting a Run dialog command.

Malicious High Risk Local/domain Local Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).

Malicious RDP Reconnaissance with Valid Credentials Performed on Multiple Hosts (via security)

This rule detects brutforce RDP services with compromised credentials via tools like Hydra. Note that this event will be reported only with valid user and password credentials, and it may be reported only when RDP session is fully opened (so not during reconnaisance phase) if NLA is disabled. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) should be used.

Suspicious curl Download of nvidiadrivers Archive to Temp (via process_creation)

This rule detects curl retrieving an archive named nvidiadrivers.zip into the user temp directory. The Lazarus ClickFake Interview campaign uses this command to stage its payload while masquerading as a legitimate GPU driver update. The specific archive name written to a temporary path with certificate checks disabled indicates malicious staging.

Suspicious Wscript Execution of File With Media Extension

This rule detects wscript.exe executing a file that carries a media or image extension such as .3gp. LNK-based malware renames script files with deceptive extensions to evade detection while the script host still interprets them. A script host running a supposed media file indicates masquerading and script-based execution.