Sigma detection rules, expert-reviewed

Malicious Windows Defender Exclusion Added (via registry_set)

This rule detects new Windows Defender exclusion entries for paths or processes, a defense evasion step used by Raspberry Robin to prevent detection of its payloads. Attacker-driven exclusion writes let malware run unscanned, so unexpected additions to the Defender Exclusions keys are high-value indicators.

Suspicious RoboForm Update Run Key Masquerade (via registry_set)

This rule detects an HKLM Run value named RoboForm Update pointing to a binary outside the legitimate RoboForm install path, a persistence masquerade used by PlugX in the SmugX campaign. The technique blends the autostart entry with a trusted product name while launching a sideloaded loader from a staging directory.

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

This rule detects trueconf_windows_update.exe launching a .tmp executable, the supply-chain execution chain observed in Operation TrueChaos where a trojanized TrueConf updater drops and runs a Havoc payload. A signed-looking updater executing a temporary binary is anomalous and marks the initial loader stage.

Suspicious Termination of Windows Security Health UI via taskkill

This rule detects forced termination of SecHealthUI.exe, the Windows Security notification UI, via taskkill, an action GachiLoader takes to suppress security alerts to the user. Killing the Defender interface component is a defense-evasion behavior with little legitimate cause.

Suspicious Defender Exclusion Added via Add-MpPreference by GachiLoader

This rule detects use of Add-MpPreference with an ExclusionPath or ExclusionExtension argument, a Microsoft Defender tampering step GachiLoader performs to whitelist its payload directories before staging. Attacker-driven exclusion changes carve blind spots into endpoint protection and precede malware deployment.

Malicious Forced Deletion of Security Vendor Kernel Drivers by ValleyRAT

This rule detects command-line forced deletion of kernel driver files belonging to Chinese and mainstream security vendors such as 360, Huorong, Tencent and Kaspersky, an anti-defense step ValleyRAT executes to blind endpoint protection before deploying its rootkit. Deleting vendor .sys files by force is a strong impairment-of-defenses indicator.

Suspicious IP Release and Renew via Minimized cmd During Driver Install

This rule detects a minimized cmd shell chaining ipconfig /release and /renew, a network-flap trick ValleyRAT performs to mask connectivity loss while it installs its stealth kernel driver. The minimized-window start combined with a release-then-renew sequence in one command is anomalous and points to the rootkit installation routine.

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

This rule detects execution of RuntimeBroker.exe from C:\Program Files\RunTime, a masquerading location used by the Silver Fox APT to deploy its ValleyRAT loader. The legitimate RuntimeBroker.exe lives in System32, so a same-named binary under a RunTime folder is a trusted-name wrong-context indicator of the ValleyRAT dropper.

Suspicious Execution of Dotnet Injection Target Utilities

This rule detects execution of InstallUtil, AddInProcess32, or CasPol outside of a development context, the signed dotnet utilities abused as injection hosts by the PureHVNC loader from the fake Kling AI site. The loader hollows these trusted binaries to run its RAT payload. Detecting unexpected launches exposes process injection into living off the land binaries.

Malicious Shadow Copy Deletion via vssadmin

This rule detects vssadmin deleting all volume shadow copies quietly, an inhibit recovery step in the FunkSec ransomware chain. Removing shadow copies prevents victims from restoring encrypted files. Detecting it exposes recovery sabotage that typically precedes encryption.

Malicious Security Event Log Disabled via wevtutil

This rule detects wevtutil disabling the Security event log channel, a logging impairment used by FunkSec ransomware to hide its actions. Disabling the Security log blinds defenders to subsequent malicious activity. Detecting the command surfaces anti forensic behavior on the host.

Malicious Defender Real Time Monitoring Disabled via Set-MpPreference

This rule detects PowerShell disabling Microsoft Defender real time monitoring through Set-MpPreference, an impairment step in the FunkSec ransomware routine. Turning off real time protection lets the encryptor and its tools run without interference. Detecting the command exposes defense evasion before encryption.

Malicious BugSleep Scheduled Task Persistence with Sample Comment

This rule detects creation of a scheduled task carrying the literal description sample comment, a fingerprint of the BugSleep backdoor deployed by MuddyWater. The malware registers a task named after its mutex with this hardcoded comment and a thirty minute trigger. Detecting the constant comment string exposes the backdoor persistence.

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

This rule detects abuse of the signed SyncAppvPublishingServer.vbs script to proxy execution of PowerShell, a technique used in the GuLoader to Remcos infection chain. The LNK lure invokes this LOLBIN to run obfuscated PowerShell that stages shellcode. Detecting the script use surfaces the proxied execution step of the chain.

Suspicious Execution of spools.exe from Public Directory

This rule detects execution of a binary named spools.exe from the C-Users-Public directory, a masquerade of the Windows print spooler dropped by the IndigoZebra APT. Placing a spooler lookalike in a world writable public path is a strong sign of the group dropper. This catches the staged payload before it establishes persistence.