Sigma detection rules, expert-reviewed

Suspicious PowerShell Remote Payload Download via IEX DownloadString

This rule detects PowerShell invoking Invoke-Expression together with a WebClient DownloadString call which the attackers used to fetch and execute in memory payloads during the campaign targeting Japan. Combining remote content download with immediate expression execution is a common fileless delivery technique.

Malicious PowerShell Spawned by PHP CGI Process

This rule detects the php-cgi.exe process spawning PowerShell which indicates exploitation of CVE-2024-4577 argument injection to achieve remote code execution on Windows PHP servers as seen in the persistent attacks against Japanese organizations. A web facing PHP CGI interpreter launching PowerShell is not expected during normal operation and signals server compromise.

Suspicious Executable Running from Public Pictures Directory

This rule detects execution of binaries located under the Users Public Pictures directory which the Lotus Blossom group uses as a staging location for its hacking tools and backdoor components. Executables running from a media folder that normally holds only images are a strong indicator of tool drop and execution.

Suspicious Python Execution via Renamed Synaptics Binary

This rule detects a process named synaptics.exe executing inline interpreter code through a dash c argument which the PXA Stealer campaign achieves by shipping a portable Python interpreter renamed to synaptics.exe to blend in with the legitimate touchpad driver. Running interpreter style command arguments from a synaptics named binary is a masquerading indicator of stealer execution.

Suspicious Remote Admin Share Execution via Conhost

This rule detects the console host process conhost.exe launched with arguments referencing a remote administrative admin share which Interlock ransomware operators abuse for lateral movement and remote command execution. Conhost invoked with a remote drive share path is anomalous because it is normally spawned locally by console applications without any network share argument.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.

Suspicious File Download Via Bitsadmin Transfer

This rule detects bitsadmin.exe invoked with a transfer job pointing to a remote URL. TA866 abused bitsadmin alongside certutil to pull additional payloads onto compromised hosts. Using the BITS admin tool to download files is a living-off-the-land ingress and BITS-jobs technique that evades naive download monitoring.

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

This rule detects a command line that changes the console code page with chcp and then runs nltest for domain trust enumeration. TA866 Asylum Ambuscade used cmd.exe with chcp 65001 chained to nltest DOMAIN_TRUSTS during host reconnaissance. A UTF-8 code-page switch immediately preceding domain trust enumeration is a scripted discovery pattern tied to this actor.

Malicious Shadow Copy Deletion Via WMI

This rule detects PowerShell querying Win32_Shadowcopy and piping the result to Remove-WmiObject to delete volume shadow copies. Akira ransomware used Get-WmiObject Win32_Shadowcopy piped to Remove-WmiObject to destroy shadow copies before encryption. Deleting shadow copies is an inhibit-recovery action that prevents victims from restoring files without paying the ransom.

Suspicious Domain Trust Discovery Via Nltest

This rule detects nltest.exe enumerating domain trust relationships. UAT-5647 ran nltest domain_trusts to map Active Directory trusts during reconnaissance in the RomCom intrusions. Nltest domain trust enumeration is a common domain-discovery action attackers use to plan lateral movement across trusted domains.

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

This rule detects command lines containing the Mimikatz sekurlsa logonpasswords credential-dumping directive. DragonRank ran rundll32 with the sekurlsa logonpasswords module to harvest credentials from LSASS memory. The sekurlsa logonpasswords string is a distinctive Mimikatz artifact indicating active OS credential theft.

Suspicious Office Application Spawning Script Or Shell Interpreter

This rule detects a Microsoft Office application spawning a command shell or scripting interpreter. MacroPack-generated maldocs used VBA to launch child interpreters that injected and executed offensive-tool loaders such as Havoc and Brute Ratel. Office applications spawning cmd powershell wscript or rundll32 is a strong macro-abuse signal for the initial execution stage of an intrusion.

Suspicious Office Application Spawning Mshta With Remote HTA

This rule detects a Microsoft Office application spawning mshta.exe with a remote HTTP or HTTPS URL. Threat actors using MacroPack-built documents launched mshta from Office to fetch remote HTA payloads that loaded Havoc Brute Ratel and PhantomCore. Office spawning mshta to pull a remote HTA is a phishing execution chain that bridges a malicious macro to a fileless second stage.

Suspicious PowerShell Download Of Text-Disguised Payload

This rule detects PowerShell downloading a file with a .txt extension using a web download method. MoonPeak loaders retrieved a calc.txt file that was actually a GZIP-compressed RTF payload staged for later conversion and execution. Serving executable or archive content under an innocuous .txt name is a masquerading trick used to slip payloads past content filters.

Malicious NetSupport RAT Client32 Execution

This rule detects execution of client32.exe the NetSupport Manager remote-control client binary from a user-writable directory. Threat actors repackaged NetSupport Manager as a RAT delivered through fake browser update lures in this campaign. NetSupport client32 running from temp or profile paths rather than an installed program directory indicates abuse for unauthorized remote access.