Sigma detection rules, expert-reviewed

Renamed Qbot Loader Execution via rundll32 Running DAT File with xlAutoOpen Export (via process_creation)

This rule detects rundll32.exe invoking a .dat file through the xlAutoOpen export, the execution behavior a Qbot XLL phishing chain uses to run its decrypted loader before injecting into wermgr.exe. Adversaries reuse the Excel add-in entry point from a renamed DLL to launch the banking trojan under a trusted binary, making early detection critical for stopping the intrusion at the loader stage.

Malicious UpdatusUser Local Account Creation by Secret Blizzard

This rule detects creation of a local account named UpdatusUser via net user. Microsoft attributed this masquerading account name to Secret Blizzard establishing persistence during its AiTM campaign. The name mimics a legitimate updater service but is created interactively, so this specific account name is a high-confidence persistence indicator.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Malicious AMSI Bypass via AmsiUtils amsiInitFailed Manipulation

This rule detects PowerShell script content that disables the Antimalware Scan Interface by reflecting into System.Management.Automation.AmsiUtils and setting the amsiInitFailed field to true. This in-memory AMSI bypass was observed during React2Shell CVE-2025-55182 exploitation to blind endpoint scanning before executing follow-on payloads.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Caching

This rule detects the WDigest UseLogonCredential registry value being set to 1, forcing Windows to cache plaintext credentials in memory as documented by Huntress. Attackers enable this setting before dumping LSASS so that cleartext passwords are recoverable. This modification undermines credential protection and is a strong precursor to credential harvesting.

Suspicious Windows Firewall Disabled via netsh by BlackByte Ransomware

This rule detects netsh disabling all Windows Firewall profiles, a defense evasion action used by BlackByte ransomware to remove network restrictions before spreading. Turning off all firewall profiles is rarely legitimate on managed endpoints.

Suspicious Hidden Window PowerShell with Modified Execution Policy (via process_creation)

This rule detects PowerShell launched with a hidden window and a bypassed or relaxed execution policy in a single command line. DragonForce and many ransomware loaders use this combination to run staging scripts silently, evading user awareness and default script-execution restrictions.

Suspicious Chrome Remote Desktop Host Silent Binding for Remote Access (via process_creation)

This rule detects headless registration of a Chrome Remote Desktop host using the start host binary with authorization code redirect and pin arguments, the remote access tool abuse observed in a Kimsuky campaign to obtain interactive control of victim machines. Adversaries leverage legitimate remote desktop software to blend with sanctioned IT tooling while retaining hands on keyboard access, making early detection critical for exposing unauthorized remote sessions.

Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)

This rule detects the VMware Tools guest process vmtoolsd.exe spawning a command interpreter such as cmd.exe or powershell.exe. Fire Ant abused hypervisor level access and CVE-2023-20867 to execute commands inside guest virtual machines from a compromised ESXi host, producing an unusual parent-child chain that does not occur during normal VMware Tools operation.

Malicious Local Administrator Added by Atera RMM Agent

This rule detects the AteraAgent process spawning net.exe to add an account to the local administrators group, an abuse chain Huntress observed during bulk attacks leveraging RMM tools against MSP-managed endpoints. Attackers who gain access to an RMM tenant push commands that create privileged accounts for persistence. Privileged account changes originating from an RMM agent are a strong indicator of tenant abuse.

Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)

This rule detects execution of an image whose name ends in a data-to-executable double extension such as .dat.exe, matching the STOCKSTAY chain where an HTA renamed a styles.dat payload to styles.dat.exe and ran it through WScript.Shell. Adversaries use double extensions to disguise executable payloads as inert data files, so running such a file is a strong masquerading indicator.

Suspicious FatalRAT Keylog File Creation in Windows Directory (via file_event)

This rule detects creation of the FatalRAT keylog artifact Fatal.key in the Windows directory. This behavior was observed in Operation SalmonSlalom where the backdoor recorded captured keystrokes to a fixed file for later collection. Detecting this artifact reveals credential and input capture activity on the host.

Suspicious rclone Masquerading as Avast Binary by The Gentlemen RaaS (via process_creation)

This rule detects execution of a binary named avastrclone.exe, the renamed rclone client The Gentlemen operators disguise as an Avast component to blend in while exfiltrating data over cloud storage. The masqueraded name combines a legitimate-looking brand with an untrusted tool. Detecting it exposes covert bulk exfiltration.

Suspicious Edgecution Decryption Key Storage in Edge AppKey Value (via registry_set)

This rule detects creation of a non standard AppKey value under the HKCU Microsoft Edge key where Edgecution stores the hex string used to decrypt strings inside its Python backdoor. The genuine Edge configuration does not use an AppKey value in this location.

Malicious Shadow Copy Deletion via vssadmin Delete Shadows (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly, the inhibit-recovery step in the RansomHub intrusion performed alongside log clearing before encryption. Adversaries destroy shadow copies so victims cannot restore files without paying, so this command outside a maintenance window is a strong pre-encryption impact indicator.