Sigma detection rules, expert-reviewed

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

This rule detects wscript.exe or cscript.exe spawning PowerShell with execution-policy bypass and no-profile command execution flags. This chain was observed delivering NetSupport RAT where a JavaScript ActiveXObject WScript.Shell launched PowerShell to fetch the payload. Script hosts invoking hidden bypass PowerShell is a common loader pattern that downloads and runs second-stage malware.

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

This rule detects a scheduled task creation that masquerades as a Microsoft Edge update task while pointing its action at an executable under the temp directory which the SpiceRAT loader uses for persistence. A legitimate-looking update task name paired with a temp path payload is a strong masquerading plus persistence signal.

Suspicious Scheduled Task Created From XML Definition (via process_creation)

This rule detects schtasks creating a task from an external XML definition file which the Cosmic Leopard Windows component uses to establish persistence. Importing a task from an XML blob lets attackers set arbitrary triggers and actions while avoiding inline command inspection.

Malicious Service Creation With Autostart binPath via sc.exe (via process_creation)

This rule detects creation of a new Windows service with an automatic start type through sc.exe which the LilacSquid actor uses to persist its InkLoader component under a service named TransactExDetect. Service creation with auto start is a durable persistence and privilege mechanism favored for loading stealthy RAT loaders at boot.

Suspicious Windows Defender Exclusion Added for ProgramData (via process_creation)

This rule detects command lines that add a Microsoft Defender exclusion path covering C:\ProgramData which the CoralRaider batch script uses to hide staged payloads from antivirus scanning. Adding scan exclusions is a common impairment of defenses that lets malware execute and persist from a trusted allowlisted directory.

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

This rule detects the Windows print spooler binary name spoolsv.exe executing from a directory outside System32 which the CoralRaider RotBot component uses to masquerade as a trusted system service. Running a well-known system image name from a wrong location is a strong masquerading signal used to evade defender and analyst attention.

Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)

This rule detects silent unattended installation of the AnyDesk remote access tool through Windows Installer command lines which threat actors and ransomware operators abuse to gain persistent hands-on-keyboard access. Adversaries increasingly deploy legitimate RMM tooling such as AnyDesk to blend malicious remote control with normal administrative traffic and evade endpoint controls.

Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)

This rule detects creation of a service whose binary path runs svchost.exe under a custom sysman service group, the persistence mechanism in the full TinyTurla kill chain. Registering a new svchost group allows the backdoor ServiceDll to load inside a trusted host process at boot.

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

This rule detects execution of the edgeparser.ps1 script used by Turla in TinyTurla-NG operations to parse and steal Microsoft Edge Login Data. The script harvests saved browser credentials for onward access and lateral movement.

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring an executable or DLL from an HTTP source, a payload-staging technique seen in the LATAM Google Cloud Run malware campaigns delivering Astaroth, Mekotio and Ousaban. Abusing the BITS service downloads next-stage tooling while evading direct network monitoring.

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

This rule detects scheduled task creation using the Zardoor masquerade names KasperskySecurity or msbuildss.exe. The actor names persistence tasks after security software and build tooling to blend malicious execution into expected system activity.

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

This rule detects msdtc.exe being invoked with the -install argument, the trigger used by the Zardoor backdoor to sideload a malicious oci.dll. Abusing the MSDTC install path loads attacker code under a signed system service for stealthy persistence.

Malicious Service Creation Masquerading as nslookup (via process_creation)

This rule detects creation of a Windows service whose binary is named nsIookup.exe, a homoglyph masquerade of nslookup used by Lazarus for persistence in Operation Blacksmith. Naming the service payload after a trusted networking tool helps it evade casual review.

Windows Firewall Disabled via netsh advfirewall

This rule detects netsh being used to turn off the Windows Firewall through the advfirewall set allprofiles state off command. Phobos ransomware disables the firewall to ease lateral movement and unhindered communication before encryption. Programmatic firewall disabling is a defense-evasion action uncommon outside deliberate administration.