Sigma detection rules, expert-reviewed

Malicious UAC Disable via EnableLUA Registry Modification (via registry_set)

This rule detects the EnableLUA registry value being set to 0, which disables User Account Control, as performed by Phobos ransomware affiliates. Disabling UAC removes elevation prompts and eases silent execution of privileged operations during the intrusion.

Persistence Run Key Pointing to svchost.exe in AppData Roaming

This rule detects a Run key autostart entry whose value references svchost.exe located under a user AppData Roaming path. The Yashma ransomware established persistence through a Run key pointing at its dropped svchost.exe masquerade copy. This lets the ransomware survive reboots by abusing a trusted process name from an illegitimate location.

Malicious AMSI and ETW Patching via PowerShell Script

This rule detects PowerShell script content that references AmsiScanBuffer or EtwEventWrite in order to patch the Antimalware Scan Interface and Event Tracing for Windows, an in-memory evasion step UAT-11795 performs before injecting the Starland RAT as reported by Cisco Talos. Tampering with these logging and scanning interfaces blinds defenses. Detecting the patch strings exposes active defense evasion in the loader.

Malicious PowMix AMSI Bypass via amsiInitFailed

This rule detects PowerShell script content that forces the amsiInitFailed condition to disable the Antimalware Scan Interface, matching the PowMix botnet loader targeting Czech users. Setting amsiInitFailed causes AMSI to skip scanning subsequent in-memory payloads, letting the fileless PowMix stager execute undetected. Presence of this bypass in script telemetry is a high-confidence evasion indicator.

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

This rule detects use of the Get-Clipboard PowerShell cmdlet to read clipboard contents, a collection technique used by BeaverTail and OtterCookie to steal credentials and cryptocurrency wallet data. Automated clipboard reads outside interactive use are a common infostealer behavior. This activity supports credential theft and data collection.

Malicious Msiexec Execution of Staged Update Package via Process Creation

This rule detects msiexec.exe executing the update_ms.msi package staged in ProgramData, the installer proxy-execution step that loads the msaRAT lib.dll RUN export as reported by Cisco Talos in the Chaos ransomware campaign. Running a fetched MSI from ProgramData under msiexec launches the covert browser C2 implant. Detecting this execution catches proxy execution of the malicious installer after ingress.

Malicious Curl MSI Download to ProgramData via Process Creation

This rule detects curl.exe downloading a Windows Installer package into the ProgramData directory, the payload staging behavior of the Chaos ransomware msaRAT loader reported by Cisco Talos. The tool fetches update_ms.msi from an attacker IP and writes it to ProgramData before execution. Detecting this retrieval catches ingress of the MSI that unpacks the covert browser-based C2 implant.

Suspicious Child Process Spawned by Python Interpreter via Process Creation

This rule detects python.exe spawning living-off-the-land binaries such as calc.exe, curl.exe, cmd.exe, or powershell.exe, the import-time execution behavior of the malicious PyPI packages analyzed by Cisco Talos. Trojanized packages run payloads from __init__.py or setup.py the moment they are imported or installed. Flagging these child processes surfaces supply-chain code execution on developer and build hosts.

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

This rule detects cmd.exe spawning powershell.exe with an encoded command argument as seen in the KongTuke fake-CAPTCHA infection chain reported by Cisco Talos. Encoded PowerShell launched from a shell is used to run an in-memory downloader that pulls a second stage and beacons to attacker infrastructure. Catching this early breaks the chain before payload retrieval and anti-forensic cleanup occur.

Suspicious BadIIS Native Module Registration via cmd Copy

This rule detects cmd.exe copying an architecture-suffixed 32.dll or 64.dll module with forced overwrite, matching the BadIIS deployment that registers its malicious native IIS module by copying the payload DLL into place. Silent overwrite of a bitness-named module through cmd is part of installing the server-side backdoor. This behavior indicates BadIIS module installation on an IIS host.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Suspicious CloudZ RAT Payload Download via curl to ProgramData

This rule detects curl saving a remote file into the ProgramData Microsoft WindowsDoc directory, matching the CloudZ RAT staging chain that writes update.txt into a fabricated WindowsDoc folder. Downloading a payload directly into a Microsoft-themed ProgramData path masquerades attacker tooling as system content. This ingress behavior indicates active payload retrieval.

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

This rule detects the regasm.exe LOLBin executing against content staged under ProgramData, matching the CloudZ RAT which abuses regasm to load a dropped .NET assembly outside developer workflows. Legitimate use of regasm operates on assemblies in build or install directories, not ProgramData staging folders. Execution from this location signals proxied malicious code loading.

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

This rule detects a scheduled task created to run onstart as SYSTEM that launches regasm.exe, matching the CloudZ RAT which registers a boot-time task to execute its .NET loader through the regasm LOLBin. Chaining an onstart SYSTEM task to a trusted Microsoft signed binary gives the implant privileged persistence while evading application controls. This combination is a strong indicator of CloudZ deployment.

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

This rule detects execution of a binary named DownloadedOneDriveDocument.exe, matching the n8n webhook CAPTCHA campaign that delivers a modified Datto RMM agent under a document-themed filename. Naming a remote management installer to look like a downloaded OneDrive document tricks users into running the RMM foothold. Execution of this file indicates delivery of the abused remote access tooling.