Sigma detection rules, expert-reviewed

Suspicious UAT-8302 Scheduled Task Creation for Recon Tooling

This rule detects schtasks creating tasks named ReconLiteDebug or RunWhatPC, matching the UAT-8302 persistence that schedules its host-profiling and command tooling under recognizable task names. These campaign-specific task names betray the attacker even when the underlying payload is renamed. Presence of either scheduled task indicates UAT-8302 foothold and tasking.

Suspicious Indirect Command Execution via Pcalua for UAC Bypass

This rule detects use of the Program Compatibility Assistant pcalua to indirectly launch a command which the Lazarus chain used to bypass user account control and break parent child process lineage as documented by NCC Group. Attackers proxy execution through pcalua to evade detections that key on direct parent processes.

Suspicious SQL Service Principal Name Enumeration via Setspn

This rule detects setspn.exe querying for SQL related service principal names which the ColunmTK APT41 cluster uses to identify Kerberoastable service accounts. Enumerating MSSQL SPNs precedes requesting and cracking their Kerberos tickets offline. It matters because this reconnaissance directly enables credential compromise of high privilege database accounts.

OCSP Responder Auditing Settings Changed or Disabled (via security)

This rule detects would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.

Suspicious PowMix Scheduled Task Launching LNK via Explorer

This rule detects creation of a scheduled task that runs explorer.exe against a shortcut file, matching the PowMix botnet persistence that fires a daily task at 11:00 to relaunch its malicious LNK through Explorer. Abusing explorer.exe to open an attacker LNK on a schedule masks the loader chain as ordinary shell activity. This persistence pattern indicates a PowMix foothold on the host.

Suspicious Domain Trust Enumeration via Nltest

This rule detects nltest querying domain trusts or domain controllers, an Active Directory reconnaissance step performed by the Malichus malware after exploiting Cleo file transfer software. Enumerating trusts and controllers helps attackers plan lateral movement across the domain. This discovery activity commonly follows initial access on an exposed server.

Malicious Remote XSL Script Execution via WMIC Squiblytwo Technique

This rule detects WMIC invoking a remote XSL stylesheet via the format switch which is the squiblytwo technique used by the Lazarus chain to execute attacker script content as analysed by NCC Group. Loading a remote XSL through a signed system binary evades application control and downloads code from adversary infrastructure.

Suspicious PsExec Copying Payload To Windows Temp (via process_creation)

This rule detects PsExec running as SYSTEM to copy a payload into the Windows temp directory, a lateral movement and staging pattern used to distribute the Rhysida ransomware. Remote execution that copies binaries into windows temp is characteristic of hands-on ransomware deployment across hosts.

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

This rule detects the creation of a DLL under the non-standard C\assembly\tmp staging directory used by the DCOM Upload and Execute backdoor documented by Deep Instinct. The backdoor abuses the DCOM MSI install server to upload and load a managed assembly for remote code execution. Detecting this drop exposes lateral tool transfer before the payload is loaded into a victim process.

Malicious DeceptiveDevelopment Defender Exclusion for Coin Miner via PowerShell

This rule detects PowerShell adding Microsoft Defender exclusions for cryptomining components used by the DeceptiveDevelopment cluster after a ClickFix fake-interview lure. Attackers whitelist TsunamiClient and XMRig paths so the dropped miners run undetected, and matching this behavior surfaces active defense evasion before mining begins.

Suspicious Domain Controller and Trust Enumeration via Nltest

This rule detects nltest enumerating domain controllers or domain trusts which the BlackSuit ransomware actor used to map the environment before lateral movement and this matters because bulk trust and DC listing through nltest is a frequent discovery step in intrusions and stands out against sparse legitimate use on endpoints.

Suspicious COLDRIVER Fileless Payload Storage in Explorer CLSID DefaultIcon (via registry_set)

This rule detects registry writes storing encrypted payload data in the Explorer CLSID DefaultIcon subkey using the EnthusiastMode and QatItems values as done by the COLDRIVER SIMPLEFIX loader. Storing binary blobs in this location is a fileless evasion technique.

Suspicious Hidden Encoded PowerShell Launching Node.js Runtime

This rule detects PowerShell invoked with hidden window style and an encoded command that launches node.exe, a loader chain used by the Tsundere Node.js botnet. The malware uses powershell -WindowStyle Hidden -NoLogo -enc to decode and start its Node.js payload out of sight. Combining hidden execution and base64 encoding to bootstrap a Node runtime is a strong indicator of malicious loader activity.

Suspicious Service Registration Loading Vulnerable Driver

This rule detects registry service registration where the ImagePath points to a known vulnerable kernel driver filename which adversaries create to load an exploitable driver into the kernel during bring your own vulnerable driver attacks. Creation of a service that maps to these driver binaries indicates staging of a kernel level defense evasion or privilege escalation capability.

Suspicious tapiperf.dll Load by WMI Provider Host via Image Load

This rule detects wmiprvse.exe loading tapiperf.dll, which the Lunar toolset abuses through DLL replacement to gain execution inside a trusted Windows process. Legitimately tapiperf.dll is a TAPI performance counter library and is not loaded by the WMI provider host. This anomalous load points to DLL hijacking used for stealthy persistence and code execution.