Sigma detection rules, expert-reviewed

Suspicious Autorun Persistence Masquerading as Windows Security

This rule detects creation of a Run key value named Windows Security which the PXA Stealer campaign uses to disguise its autorun persistence as a legitimate security component. A benign looking value name combined with an autorun registry location is a common masquerading technique that warrants review of the referenced executable.

Suspicious Windows Service Creation via sc.exe

This rule detects creation of a new Windows service via sc.exe with a binary path argument. Adversaries register services for persistence and to execute payloads under SYSTEM. Because software installers also create services, review the binary path and service name for anomalies.

Malicious Payload Downloaded via PowerShell (via powershell)

This rule detects download a payload using PowerShell.

Malicious Boot Configuration Tampering via bcdedit (via process_creation)

This rule detects bcdedit commands that disable recovery options or manipulate boot configuration to support pre-OS persistence. DragonForce abuses bcdedit as part of a UEFI bootkit workflow and to inhibit Windows recovery, ensuring the compromise survives reboot and hampering remediation.

Suspicious Octo Tempest Remote Access and Tunneling Tooling (via process_creation)

This rule detects execution of remote monitoring and tunneling tools favored by Octo Tempest such as ScreenConnect Ngrok and Tailscale. The actor deployed these tools to maintain covert remote access and tunnel traffic out of victim networks.

Malicious spinstall0.aspx Webshell Written to SharePoint Layouts

This rule detects creation of the spinstall0.aspx webshell within the SharePoint LAYOUTS directory, the payload dropped by ToolShell exploitation to harvest machine key material. An aspx file written into the SharePoint application layouts path is a strong indicator of webshell installation.

Suspicious DLL Side-Loading via vssvc or WorkFolders

This rule detects the trusted binaries vssvc.exe or WorkFolders.exe loading a DLL from outside the Windows system directories. SideWinder abused DLL side-loading against these signed executables to run malicious code under a legitimate process, and loads from non-system paths indicate a planted DLL.

Malicious Follina MSDT Diagnostic Tool Code Execution (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool (msdt.exe) being invoked with Follina-style parameters such as PCWDiagnostic or IT_BrowseForFile, which the CVE-2022-30190 exploit uses to run attacker code from a weaponized document. MSDT abuse is a signed-binary code-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces document-driven exploitation before the payload executes.

Possible Host Port Scan from Single Source Address (via network_connection)

This rule detects a single source address initiating a high volume of TCP connections to many distinct destination ports on one host in a short window, indicating host port scanning. Observed in Elastic Security Labs detection engineering guidance where more than fifty distinct destination ports contacted rapidly reveals reconnaissance ahead of exploitation.

Suspicious SYSVOL Group Policy Preferences Access via Share Audit

This rule detects a user account reading machine level Group Policy Preferences files under the SYSVOL policies path through Windows detailed file share auditing as described in the WithSecure lab where GPP XML files were targeted for stored credentials. Interactive user access to machine policy XML files under SYSVOL frequently indicates hunting for cpassword secrets which is an early credential access and discovery signal.

Suspicious Hidden PowerShell Download Cradle via IEX (via process_creation)

This rule detects a hidden-window PowerShell process using a download cradle and IEX to execute remote content in memory. Amatera Stealer ClickFix lures pasted this pattern to pull and run the next stage.

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

This rule detects the MSSQL server process sqlservr.exe spawning a command interpreter, indicating xp_cmdshell abuse for operating system command execution as seen in the printer-and-BitLocker extortion scheme. Attackers exploiting exposed MSSQL instances use this to run arbitrary commands and stage further tooling on the host.

RedDelta MSI Installation via Hidden PowerShell WindowsInstaller COM Object (via process_creation)

This rule detects the RedDelta delivery command that drives a hidden PowerShell process to instantiate the WindowsInstaller COM object and silently install a remote MSI with REMOVE=ALL. Adversaries leverage the scripted installer COM interface to fetch and run payloads while suppressing the installer UI, making this command pattern a strong execution indicator.

Suspicious Mshta Autorun Persistence via Registry Set

This rule detects a Run key value pointing to mshta.exe, the registry persistence UAT-11795 plants to relaunch its Starland RAT loader at logon as reported by Cisco Talos. A HKCU Run entry that invokes mshta is highly atypical of legitimate software. Detecting it exposes autorun persistence tied to the script-based loader.

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.