Sigma detection rules, expert-reviewed

Suspicious Batch File Persistence in Startup Folder

This rule detects creation of the WindowsSecure.bat file inside the Windows Startup folder, the persistence mechanism used by the Snake Python infostealer to survive reboots. Attackers place a batch launcher here so the stealer re-executes at every user logon. A batch file dropped into a Startup directory is a reliable autostart persistence indicator.

Suspicious Copy of Outlook OST Email Data File for Exfiltration

This rule detects copying of an Outlook OST offline data file, a collection step used by the ToddyCat APT before extracting messages with XstExport. The attackers used xcopy to duplicate the .ost mailbox cache to a .ost2 file so its contents could be parsed offline. Copying a locked mailbox data file is a strong indicator of local email collection ahead of exfiltration.

Malicious Local Administrator Account Creation via CherryLoader (via process_creation)

This rule detects creation of a local account named Administrater, a misspelled account name hardcoded in the CherryLoader persistence batch script. The loader created this account and added it to the local administrators group for persistent access.

Malicious Windows Event Log Clearing via PowerShell

This rule detects Windows event log clearing performed through PowerShell log-management methods, an anti-forensic action Qilin ransomware used to wipe event logs during its intrusion. Programmatic clearing of event logs is rarely legitimate and typically indicates an adversary covering tracks.

QBot scheduled task REGSVR32 with C$ image path

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Suspicious Cloudflared Tunnel Execution via Renamed svchost Binary

This rule detects a process named svchost.exe running Cloudflare tunnel arguments from outside the System32 directory, matching the renamed cloudflared tunnel used by the RMMProject operators for covert C2 access. Adversaries rename cloudflared to svchost.exe to blend in while establishing an outbound tunnel. A svchost image running tunnel arguments from a non-system path is anomalous and indicates masqueraded tunneling.

Malicious BYOVD ThrottleStop Vulnerable Driver Load (via image_load)

This rule detects loading of the ThrottleStop vulnerable driver including the renamed ThrottleBlood.sys variant used in a Bring Your Own Vulnerable Driver attack to terminate security products. The driver exposes a device that lets an unprivileged process kill protected antivirus and EDR processes such as MsMpEng and SentinelAgent. Loading this kernel driver on a server or workstation with no ThrottleStop application present is highly suspicious.

Suspicious Rclone Configuration File Creation in User Config Directory

This rule detects creation of an Rclone configuration file under a user config directory which stores the cloud remote definitions used for exfiltration. NCC Group observed rclone.conf written under the user profile before data transfer to MEGA. Presence of this artifact indicates staging of an exfiltration channel.

Suspicious Domain Computers Group Enumeration via Net Command (via process_creation)

This rule detects enumeration of the domain computers group using the net command, a discovery step observed during SolarWinds Web Help Desk post-exploitation. Observed in Elastic Security Labs telemetry where net group domain computers /domain maps Active Directory assets to plan lateral movement.

SharpHound Enumeration via SMB Named Pipes (via security)

This rule detects enumerate different host via named pipes with SharpHound for discovery purposes.

Suspicious Microsoft Teams Installer Masquerade via MC Teams Binary (via process_creation)

This rule detects execution of a binary named MC Teams.exe, the signed malware sample Red Canary documented masquerading as a Microsoft Teams installer while carrying a Neural Code Technologies Inc. signer. The legitimate Teams installer does not use this filename, so its execution suggests a freshly signed masquerading binary abusing code-signing trust.

Malicious RDP Session Hijack via Service Creation Abuse (via security)

This rule detects create a service that triggers TSCON in order to preform local RDP session hijack.

NTFS Symbolic Link Configuration Change (via process_creation)

This rule detects modify the type of symbolic link than can be created.

Suspicious AutoIt Script Execution of AU3 Payload (via process_creation)

This rule detects an AutoIt interpreter executing an AU3 script, the execution stage DarkGate uses to decrypt and inject its payload. DarkGate operators abuse legitimate AutoIt binaries, often renamed, to run encrypted AU3 scripts. Legitimate AU3 execution exists, so pairing with staging context reduces noise.

Suspicious PowerShell Get-Content Piped to PowerShell (via process_creation)

This rule detects PowerShell reading a file with Get-Content and piping the result through Out-String into another PowerShell instance. The STEADY#URSA campaign used this pattern to execute the covert SUBTLE-PAWS backdoor stager.