Sigma detection rules, expert-reviewed

Suspicious Rundll32 Execution with IcedID Loader Export (via process_creation)

This rule detects rundll32.exe invoking the PluginInit export or referencing license.dat, artifacts of the forked IcedID loader. The loader ran its DLL through the non-standard PluginInit export and stored its bot module as license.dat.

Suspicious Script Interpreter Spawned by OneNote via Embedded Attachment (via process_creation)

This rule detects OneNote spawning a command shell, script host, or download utility, which indicates an embedded attachment was executed. Multiple actors abused OneNote .one files to launch cmd, PowerShell, wscript, mshta, or curl to retrieve AsyncRAT, XWorm, Qbot, and DOUBLEBACK.

Suspicious dMSA Object Access with Migration AccessMask

This rule detects access to a delegated Managed Service Account object with the AccessMask 0x20 that corresponds to the dMSA migration operation. The BadSuccessor technique reads and manipulates dMSA objects to hijack privileges of a preceding account. This object access pattern helps surface abuse of the dMSA migration workflow.

Malicious Run Key Persistence Named SystemAgentService

This rule detects a registry autorun value named SystemAgentService being written under the current user Run key. The Vidar stealer campaign creates this value to survive reboots while impersonating a Microsoft service name. Catching the run key write reveals user-level persistence established by the stealer loader.

Suspicious Run Key Persistence Pointing to ProgramData Executable (via registry_set)

This rule detects a Run key registry value referencing ProgramData\wt.exe, the autostart persistence used in the Axios supply chain attack to relaunch the masqueraded PowerShell payload at logon. A Run key pointing to an executable in ProgramData reflects malware ensuring survival across reboots.

Suspicious BlackBeard Persistence via WDLP File Association (via registry_set)

This rule detects registration of the custom .wdlp file extension under the HKCU Classes key, a persistence mechanism used by the BlackBeard payload in Boggy Serpens operations alongside a startup Oregon.wdlp file. The bespoke file association triggers malicious code when the associated file type is opened, establishing user-level persistence.

Suspicious Run Key Persistence Pointing to WScript via PhantomVAI Loader (via registry_set)

This rule detects a Run registry key persistence entry whose value invokes WScript, the persistence mechanism used by the PhantomVAI loader to re-launch its script stage at logon. Registering a script host under Run ensures the loader survives reboots. Detecting this write surfaces persistent infostealer staging on the host.

Suspicious Run Key Persistence Named Updater

This rule detects a Run key value named Updater pointing at a binary in a user-writable directory such as AppData ProgramData or Temp. AdaptixC2 establishes autostart persistence by creating a Run key called Updater. An Updater autorun entry executing from a non-standard path is suspicious masquerading persistence.

Suspicious ClickFix Command Execution via RunMRU Registry Key

This rule detects commands written to the Explorer RunMRU registry key that reference LOLBins such as mshta powershell curl or cscript. Adversaries running the ClickFix social engineering attack trick users into pasting attacker-supplied commands into the Windows Run dialog which persists them in RunMRU. Catching this reveals the initial user-executed loader stage before the second-stage payload runs.

Suspicious Run Key Persistence Executing VBScript as WindowsSecurityCheck

This rule detects a Run key named WindowsSecurityCheck whose value launches a .vbs script. The KimJongRAT stealer sets this entry to run a VBScript at logon while masquerading as a security component. A security-themed autorun name pointing to a script indicates malicious persistence.

Suspicious Logon Script Persistence via UserInitMprLogonScript

This rule detects modification of the HKCU Environment UserInitMprLogonScript value, which registers a script that runs at each user logon. The Blitz malware abuses this rarely-used key for persistence. Because few legitimate applications set this value, changes are a high-confidence persistence indicator.

Suspicious RunOnce Persistence Pointing to User AppData

This rule detects a RunOnce registry value whose payload path resides in the user AppData directory. The DarkCloud stealer establishes persistence through HKCU RunOnce entries referencing its dropped AutoIt-compiled executable. A RunOnce value launching a binary from a user-writable location is a common malware persistence pattern.

Malicious SnipBot COM Hijack via InprocServer32 CLSID (via registry_set)

This rule detects registry writes to the InprocServer32 subkey of CLSID 2155fee3-2419-4373-b102-6843707eb41f, the COM object SnipBot hijacks to persist and execute its payload. COM hijacking gives the RomCom operator stealthy persistence triggered by normal application activity.

Malicious FalseFont Backdoor Run Key Persistence from AppData (via registry_set)

This rule detects a Run key persistence value pointing to a host.exe or broker.exe binary under an AppData path, the autostart mechanism the FalseFont backdoor uses to survive reboots. FalseFont is attributed to the Curious Serpens espionage actor, and running these implants from a user writable directory via a Run key is a clear sign of established backdoor persistence.

Suspicious Port Proxy Persistence Registry Key Creation (via registry_set)

This rule detects modification of the PortProxy v4tov4 tcp registry subtree that stores netsh port forwarding rules, the persistence footprint left when Volt Typhoon establishes an internal relay. Legitimate administrative use of port proxies is rare in most environments, so writes under this key warrant investigation for covert traffic tunneling.