Sigma detection rules, expert-reviewed

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

This rule detects the creation of a file named CriticalBreachDetected.pdf, the fixed ransom note dropped by Rhysida ransomware. Rhysida writes this note across affected directories after encrypting files. Detecting the note filename provides a high-confidence indicator that Rhysida encryption has already occurred on the host.

URL Shortcut File Created in Startup Folder for Persistence

This rule detects the creation of a .url shortcut file inside a Windows Startup folder. The Yashma ransomware planted a .url startup file to relaunch its payload at logon. Attackers abuse Startup-folder shortcut files to achieve low-privilege persistence that runs automatically for the affected user.

Malicious Qilin EDR Killer BYOVD Driver Load

This rule detects loading of the vulnerable drivers rwdrv.sys or hlpdrv.sys used by the Qilin EDR killer as a bring-your-own-vulnerable-driver toolkit. The rwdrv.sys component is a renamed ThrottleStop driver abused alongside hlpdrv.sys to gain kernel access for terminating protected security processes. Loading either driver indicates an attempt to disable endpoint defenses ahead of ransomware deployment.

Suspicious Vulnerable ASUS AsIO3.sys Driver Load

This rule detects loading of the ASUS AsIO3.sys kernel driver, a vulnerable driver abused in this bring-your-own-vulnerable-driver technique. The driver exposes IOCTLs that grant arbitrary kernel memory access, which the actor leverages for privilege escalation and to bypass process allowlisting, so its load outside a genuine ASUS software context is a strong exploitation indicator.

Malicious Known Vulnerable Driver Load for BYOVD Attack

This rule detects loading of known vulnerable kernel drivers such as viragt64.sys dbutil_2_3.sys zamguard64.sys RtCore64.sys gdrv.sys and empntdrv.sys which adversaries abuse in bring your own vulnerable driver attacks to disable security tooling and gain kernel level execution. Presence of these driver filenames loading on an endpoint is a strong indicator of privilege escalation or defense evasion activity.

Suspicious Remote Management C2 Subdomain Resolution

This rule detects DNS resolution of upload[1-4].am.remote.management style hostnames used as command-and-control and data-upload endpoints in this Brazilian RMM-abuse spam campaign. The structured am.remote.management pattern with a numbered upload prefix is the operator infrastructure receiving exfiltrated data through abused remote monitoring tooling.

Possible Telegram API Command and Control DNS Query

This rule detects DNS resolution of api.telegram.org, the endpoint used by YoroTrooper for Telegram-based command-and-control and data exfiltration. Multiple threat actors abuse the Telegram Bot API as a resilient web-service C2 channel. Because legitimate applications also use Telegram, this signal is provided at low confidence and should be correlated with other host activity.

Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos

This rule detects creation of an UpdateCheck value under a Windows Run key, the autostart persistence mechanism used in Operation TrueChaos to relaunch the Havoc loader at logon. A masquerading update-check value written to a Run key is an established persistence indicator for this campaign.

Malicious ValleyRAT KernelQuick Rootkit Service and Shellcode Store Registry Keys

This rule detects registry writes to the kernelquick kernel-driver service key and to the HKLM\SOFTWARE\IpDates key used by ValleyRAT's kernel rootkit component to register its driver and stash shellcode. These fixed key names are unique to the ValleyRAT rootkit and indicate installation of its kernel-level hiding and persistence layer.

Malicious Silver Fox BYOVD Vulnerable Driver Service Creation

This rule detects creation of the kernel service entries named Termaintor or Amsdk_Service that the Silver Fox APT registers to load the vulnerable amsdk.sys driver in a bring-your-own-vulnerable-driver attack. The driver is abused via IOCTL 0x80002048 to terminate security product processes, so these service names indicate an in-progress endpoint-defense-disabling operation preceding ValleyRAT injection.

Suspicious Run Key Persistence Pointing to AppData Local Copy

This rule detects a Run key autostart entry whose target is an executable copied into the AppData Local directory, the persistence pattern used by the PureHVNC loader distributed through the impersonated Kling AI site. The loader copies itself into the user profile and registers a Run value to survive reboot. Detecting it exposes the persistence foothold.

Malicious WezRat Persistence via Chrome Updater Run Key

This rule detects a Run key value named Chrome Updater pointing to Updater.exe, the persistence and masquerade used by the WezRat backdoor. The malware disguises its autostart as a Chrome update component to appear benign. Detecting the named value with its Updater.exe target exposes the implant persistence.

Suspicious Image File Execution Options Debugger Hijack (via registry_set)

This rule detects a Debugger value being set under an Image File Execution Options key, an IFEO hijack Raspberry Robin uses to redirect or persist execution. Setting a Debugger entry causes an arbitrary program to launch whenever the target image runs, a technique with little legitimate use outside debugging tools.

Malicious Windows Defender Exclusion Added (via registry_set)

This rule detects new Windows Defender exclusion entries for paths or processes, a defense evasion step used by Raspberry Robin to prevent detection of its payloads. Attacker-driven exclusion writes let malware run unscanned, so unexpected additions to the Defender Exclusions keys are high-value indicators.

Suspicious RoboForm Update Run Key Masquerade (via registry_set)

This rule detects an HKLM Run value named RoboForm Update pointing to a binary outside the legitimate RoboForm install path, a persistence masquerade used by PlugX in the SmugX campaign. The technique blends the autostart entry with a trusted product name while launching a sideloaded loader from a staging directory.