Sigma detection rules, expert-reviewed

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

This rule detects the DISM component DismCore.dll being loaded by msedge.exe, matching the LucidRook side-loading chain where a renamed DISM host loads a trojanized DismCore.dll. Microsoft Edge has no legitimate reason to load DISM servicing libraries, so this pairing reveals DLL search-order hijacking. The load indicates the LucidRook implant is being activated.

Malicious BadIIS Module Load into IIS Worker Process by UAT-8099

This rule detects the IIS worker process loading one of the BadIIS native module DLLs used by UAT-8099. The actor deploys modules such as iis32.dll and iis64.dll to passively backdoor Internet-facing web servers. A worker process loading these attacker-specific DLLs indicates a malicious IIS module is active.

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

This rule detects the IIS process inetinfo.exe loading wmicodegen.dll, a DLL sideloading technique UAT-8099 uses to run Cobalt Strike on compromised web servers. The inetinfo.exe process has no legitimate reason to load this library. This load indicates in-memory beacon deployment via search-order hijacking.

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

This rule detects processes other than the legitimate Windows Biometric service host loading the Dell ControlVault libraries bcmbipdll.dll or BCMStorageAdapter.dll. The ReVault attack abuses ControlVault firmware vulnerabilities, and abnormal processes loading these libraries indicate exploitation attempts against the security co-processor. Such loads can lead to code execution and firmware-level persistence.

Suspicious Keylog and Screenshot Files in windows-cache Directory (OtterCookie)

This rule detects creation of the collection artifacts 1.tmp and 2.jpeg inside a windows-cache directory, where the OtterCookie module stores keystroke logs and screenshots before exfiltration. These fixed staging paths and filenames are distinctive to the malware. Their appearance indicates active input capture and screen collection.

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

This rule detects creation of encrypted implant files with distinctive names such as rdmin.src, Mcsitesdvisor.afx or winslivation.dat used by the RainyDay, Turian and PlugX variants. These files hold the encrypted payload that a legitimately signed application decrypts and loads via DLL search-order hijacking. Their appearance on disk indicates sideloading-based deployment.

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

This rule detects the PS1Bot malware framework writing its PowerShell payload ntu.ps1 into the ProgramData directory. PS1Bot is delivered through malvertising and stages obfuscated PowerShell modules from this location for in-memory execution. Script files created in ProgramData outside of installer activity are a strong indicator of staging.

Suspicious CyberLock Ransomware Encrypted File Creation

This rule detects creation of files bearing the .cyberlock extension, the marker appended by the ransomware distributed through fake AI-tool installers. Appearance of this extension indicates active encryption of user data on the host and imminent extortion.

Suspicious Web Shell File Written to IIS wwwroot Directory

This rule detects creation of server-side script files such as .aspx or .ashx within an IIS wwwroot directory by a process, which is how AntSword and China Chopper web shells were planted after UAT-6382 exploited Cityworks. Web shells dropped into the web root give the operator persistent remote command execution over HTTP against the compromised server.

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

This rule detects creation of ctrlpanel.exe under the world-writable C:\Users\Public directory which the OfflRouter VBA virus drops as its payload dropper. Placing an executable in the Public profile is a common staging technique that avoids per-user path restrictions and blends with shared content.

Phobos 8Base Ransomware Encrypted File Extension Created

This rule detects files being renamed with the .8base extension appended by Phobos ransomware operated by the 8Base group. Phobos appends an extension containing a victim ID and contact email ending in .8base to each encrypted file. A wave of these file events signals active ransomware encryption on the host.

SapphireStealer Working Directory File Drop in Temp

This rule detects files being written under a sapphire\\work directory inside the user Temp folder. SapphireStealer uses %TEMP%\\sapphire\\work as its staging directory where it drops harvested Passwords.txt, Screenshot.png and log.zip before exfiltration. Activity in this fixed working path indicates active credential and data theft staging by the stealer.

Rhysida Ransomware Encrypted File Extension Created

This rule detects files being renamed with the .rhysida extension appended by Rhysida ransomware during encryption. Rhysida uses ChaCha20 to encrypt victim files and marks each with this extension. A burst of such file events indicates active mass encryption on the host.

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

This rule detects the creation of a file named CriticalBreachDetected.pdf, the fixed ransom note dropped by Rhysida ransomware. Rhysida writes this note across affected directories after encrypting files. Detecting the note filename provides a high-confidence indicator that Rhysida encryption has already occurred on the host.

URL Shortcut File Created in Startup Folder for Persistence

This rule detects the creation of a .url shortcut file inside a Windows Startup folder. The Yashma ransomware planted a .url startup file to relaunch its payload at logon. Attackers abuse Startup-folder shortcut files to achieve low-privilege persistence that runs automatically for the affected user.