Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Masquerading As OneDrive (via process_creation)

This rule detects creation of a scheduled task named OneDrive whose action does not point to the legitimate OneDrive installation, a persistence masquerade used in the Stayin Alive campaign. Reusing a trusted product name for a task that launches a binary from an unexpected path is a common way to blend implant persistence into normal telemetry.

Malicious NTDS.dit Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating an Install From Media snapshot of the Active Directory database, the domain credential theft step used in Rhysida ransomware intrusions. Dumping NTDS.dit exposes every domain hash and is a high-severity precursor to full domain compromise.

Suspicious Event Log Clearing via Wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs, an anti-forensic step used by the Rorschach ransomware to erase traces of its activity. Bulk clearing of event logs is uncommon in normal administration and often accompanies destructive or ransomware operations.

Malicious Shadow Copy and Backup Catalog Deletion (via process_creation)

This rule detects deletion of volume shadow copies or the backup catalog through vssadmin, wmic, or wbadmin, an inhibit-recovery action executed by the Rorschach ransomware. Removing shadow copies and backups prevents victims from restoring encrypted files and is a defining ransomware behaviour.

Malicious Boot Recovery Disabled via Bcdedit (via process_creation)

This rule detects bcdedit disabling boot recovery or ignoring boot failures, an inhibit-recovery step performed by the Rorschach ransomware before encryption. Tampering with the boot configuration to block Windows recovery is a hallmark of ransomware preparing to deny system restoration.

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

This rule detects the .NET AppLaunch.exe utility being spawned as a standalone process, the hollowing target Rhadamanthys injects its stealer payload into. AppLaunch is rarely launched directly outside of a Visual Studio debugging context, so its creation by non-developer parents suggests process injection.

Malicious Regsvr32 ShellExec_RunDLL Proxy Execution (via process_creation)

This rule detects regsvr32 invoking shell32.dll ShellExec_RunDLL with the unregister and silent flags, a proxy execution trick used by Raspberry Robin to run commands through a trusted binary. This LOLBIN pattern is used to evade application controls and is not produced by normal component registration.

Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)

This rule detects creation of a scheduled task with a minute-based recurrence whose action launches PowerShell, the persistence and beaconing mechanism used by the TinyNote backdoor of Camaro Dragon. High-frequency scheduled tasks driving PowerShell are unusual for legitimate software and typically indicate implant callbacks.

Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)

This rule detects wscript or cscript launching PowerShell with an Invoke-Expression payload, the VBScript to PowerShell IEX chain used by GuLoader to deliver malware. A Windows script host spawning PowerShell to evaluate a downloaded string is a common in-memory execution pattern rarely produced by legitimate automation.

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

This rule detects the RoboForm helper binaries robotaskbaricon.exe or passwordgenerator.exe running from outside their normal install location, the DLL sideloading vector used to load a malicious RoboForm.dll in the SmugX campaign. A trusted signed name executing from a wrong path is a classic sideloading indicator.

Suspicious Plink SSH Tunnel Execution (via process_creation)

This rule detects the Plink command line SSH client being launched with port forwarding flags, a tunneling technique used by the Agrius group to proxy traffic and reach internal systems. Adversaries abuse Plink to create covert channels through perimeter defenses, which is rarely benign on endpoints.

Malicious LSASS Credential Dump via ProcDump (via process_creation)

This rule detects ProcDump being used to create a full memory dump of the LSASS process, a credential access technique observed in the Agrius MoneyBird intrusions against Israeli organizations. Adversaries dump LSASS to harvest cached credentials and enable lateral movement, so this activity strongly indicates hands-on-keyboard compromise.

Possible Remcos C2 Connection from eilowutil Process

This rule detects outbound connections from eilowutil.exe to TCP port 7060, matching the injected Remcos process and non standard C2 port in the GuLoader campaign. A process injected via GuLoader beacons out over an uncommon high port to the Remcos controller. Detecting it exposes established command and control on the host.

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

This rule detects loading of dal_keepalives.dll, a uniquely named malicious module sideloaded through signed binaries in the Stayin Alive campaign against telecoms and government ministries in Asia. The specific DLL name is a distinctive loader artifact with no legitimate use.

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

This rule detects a DLL being loaded from a directory named Z-1-36-81, the fixed staging folder CoinLoader uses for DLL sideloading. This distinctive directory constant is an artifact of the loader and is not associated with any legitimate software distribution.