Sigma detection rules, expert-reviewed

Possible Ransomware Note or Encrypted File Extension Creation

This rule detects creation of ransom note files or files renamed with encrypted extensions used by the ransomware families compared in this research. The specific note names and extensions appear only after data has been encrypted on the victim host. Detecting them confirms an active encryption event so responders can isolate the machine.

Suspicious Executable Written to User Documents Subfolder (via file_event)

This rule detects an executable being dropped into a subfolder of a user Documents directory, matching BundleBot behaviour of hiding its payload under a randomly named Documents folder. Executables rarely originate here through normal use, so writes of this kind warrant inspection for stealer staging.

Xeno Stealer Persistence via Display Calibration Run Key

This rule detects creation of a Run key value named Display Calibration used by the Xeno stealer for autostart persistence. The value points to a JAR staged under the GameDVR directory and masquerades as a benign display setting.

Hidden PowerShell Archive Extraction via ExtractToDirectory

This rule detects a hidden PowerShell process using the System IO Compression ZipFile ExtractToDirectory method together with an execution policy bypass. The Xeno loader uses this routine to unpack its bundled Java runtime and stealer payload.

Possible PurpleFox MSHTA to Msiexec Remote MSI Chain

This rule detects msiexec.exe spawned by mshta.exe to install a remotely hosted MSI package often disguised as an image file. This execution chain matches the PurpleFox loader delivery observed in MSHTA abuse campaigns.

Suspicious MSHTA VBScript WScript Shell Execution

This rule detects mshta.exe executing an inline vbscript command that instantiates WScript.Shell to run a child process. This fileless technique is used by PurpleFox and XWorm loaders to spawn cmd or PowerShell without dropping a script to disk.

Suspicious Remote HTA Payload Execution via MSHTA

This rule detects mshta.exe launched with a remote http or https URL argument to retrieve and execute a remote HTML Application payload. Loaders such as CountLoader and Emmenhtal abuse this behavior to stage LummaStealer and other malware in memory.

Suspicious Node.js Script Execution from AppData Roaming

This rule detects the Node.js runtime executing from a hidden node_x86 directory under user AppData Roaming. This matches the persistence footprint of a malicious Windsurf IDE extension that stages its loader outside standard install paths and communicates over the Solana blockchain.

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

This rule detects a ClickFix style command that decodes a hex encoded string in PowerShell and pipes the result into a second PowerShell instance for execution. This pattern delivers CastleLoader and related payloads directly in memory.

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

This rule detects extrac32.exe extracting a cabinet archive that uses a deceptive vstm extension. This delivery step was observed in CastleLoader and LummaStealer fake installer campaigns to unpack staged components.

Antivirus Software Discovery via tasklist and findstr

This rule detects reconnaissance that pipes tasklist output through findstr to enumerate running security product processes. CastleLoader performs this check to identify installed defenses before deploying its payload.

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

This rule detects execution of a batch file named RealtekCodec that masquerades as an audio helper and is launched minimized from a scheduled task. This persistence method runs the Agent Tesla loader at user logon.

Suspicious DLL Execution via Regsvr32 DllInstall of dat File

This rule detects regsvr32.exe invoking the DllInstall export against a file that uses a dat extension. This signed binary proxy execution technique runs a C2 agent DLL delivered inside fake game trainers and pirated Battlefield 6 installers.

Chisel Reverse Tunnel Tool Execution from Temporary Directory

This rule detects execution of the Chisel tunneling utility from a temporary or ProgramData directory. RedCurl deploys Chisel under an obfuscated garble and UPX packed name to pivot and tunnel through compromised networks.

Windows Defender Tampering via Set-MpPreference and Exclusions

This rule detects PowerShell commands that weaken Microsoft Defender by disabling cloud reporting and sample submission or by adding broad ProgramData exclusion paths. RedCurl performs these steps before deploying its QWCrypt ransomware.