Sigma detection rules, expert-reviewed

Suspicious Wscript Execution of File With Media Extension

This rule detects wscript.exe executing a file that carries a media or image extension such as .3gp. LNK-based malware renames script files with deceptive extensions to evade detection while the script host still interprets them. A script host running a supposed media file indicates masquerading and script-based execution.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.

Suspicious COM Hijack via CLSID InprocServer32 Pointing to Writable Path (via registry_set)

This rule detects a CLSID InprocServer32 registry value being pointed at a DLL in a user-writable directory such as Temp, AppData or ProgramData. VanHelsing hijacks COM objects by redirecting their server registration to attacker-controlled files, so a CLSID handler in a writable path indicates persistence via COM hijacking.

Malicious Shai-Hulud Bun Payload Execution via npm Preinstall Script (via process_creation)

This rule detects execution of the set_bun.js and bun_environment.js scripts used by the Shai-Hulud 2.0 npm supply chain worm, which are launched from a malicious preinstall entry in package.json to install the Bun runtime and run the worm payload. Adversaries use this staging step to establish execution inside developer and CI environments, so detecting these script invocations exposes a compromised package before credential theft and propagation occur.

Malicious Akira Ransomware Encryptor Execution (via process_creation)

This rule detects execution of the Akira ransomware encryptor invoked with its characteristic path, share and encryption-percentage arguments. Operators launched akira.exe and locker.exe with the -n, -p and -s flags to encrypt local drives and network shares.

Suspicious HTA Execution via Mshta From Shortcut Chain (via process_creation)

This rule detects mshta.exe launching an HTA file which the CoralRaider infection triggers from a malicious LNK to start its multi-stage information stealer chain. Using the trusted mshta LOLBin to run remote or local HTA content is a signed proxy execution technique that evades application controls.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Suspicious Msiexec Execution with Undocumented -z Flag Proxying DLL (via process_creation)

This rule detects msiexec invoked with the undocumented -z switch, which forces execution of the DllUnregisterServer export of a bundled library. Matanbuchus and DarkGate loaders abused this to proxy malicious DLL execution through a trusted signed binary.

Suspicious Phantom Msfte.dll Load by Search Indexer (via image_load)

This rule detects the Windows Search Indexer loading msfte.dll, a phantom DLL that does not ship with modern Windows and that attackers plant to hijack the indexer search path for stealthy persistence. Because the legitimate file is absent on current systems, a successful load of msfte.dll by SearchIndexer.exe points to a planted malicious library.

Malicious UAC Bypass via SilentCleanup Scheduled Task Trigger

This rule detects schtasks running the built-in SilentCleanup task, the trigger stage of the environment-variable UAC bypass used by NightshadeC2. After hijacking the windir variable the botnet forced SilentCleanup to run so its auto-elevated context executed the attacker payload. On-demand invocation of SilentCleanup via schtasks is a reliable indicator of this UAC bypass.

Suspicious Rclone Remote-Control Daemon For Data Exfiltration

This rule detects rclone launched with the rcd remote-control daemon argument. The MedusaLocker operator used rclone rcd to exfiltrate victim data to cloud storage before deploying ransomware. Rclone running as a remote-control daemon on an endpoint is a strong sign of automated bulk exfiltration to a cloud service.

Malicious Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell, indicative of xp_cmdshell abuse. Estate Ransomware operators enabled xp_cmdshell on a Veeam-linked MSSQL instance to run operating system commands. Command execution from the database engine signals exploitation of the SQL layer.

Suspicious msiexec Installation From Non-Standard Path

This rule detects msiexec.exe installing an MSI package from a user writable or remote location such as AppData, Temp, ProgramData or an HTTP URL, an execution-proxy technique used by the Handala group to run malicious installers from untrusted paths. Legitimate installers usually run from trusted staging or download folders rather than these locations. Combined with other indicators this points to attacker-driven payload deployment.

Suspicious AS-REP Roasting LDAP Search Filter for DONT_REQ_PREAUTH Accounts

This rule detects Directory Service search event 1644 carrying an LDAP filter that uses the bitwise OID to select accounts with the DONT_REQUIRE_PREAUTH flag set, matching Impacket GetNPUsers enumeration for AS-REP roasting. Adversaries query these accounts to request roastable tickets crackable offline. This precise bitwise filter is rarely produced by legitimate directory tooling.

Malicious NOOPDOOR Registry Persistence under Software License Key (via registry_set)

This rule detects creation of registry values under Software\License with a hex-named subkey, the storage location used by the NOOPDOOR backdoor deployed by MirrorFace against Japanese organizations. The implant hides encoded configuration and payload data in this uncommon path to survive reboots and blend with legitimate keys.