Sigma detection rules, expert-reviewed

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

This rule detects a DLL being loaded from a directory named Z-1-36-81, the fixed staging folder CoinLoader uses for DLL sideloading. This distinctive directory constant is an artifact of the loader and is not associated with any legitimate software distribution.

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

This rule detects the Cortex XDR component cy.exe loading a winutils.dll module, the DLL sideloading chain the Rorschach ransomware abuses to decrypt and inject its payload. Leveraging a trusted security tool to sideload a malicious DLL is a stealthy loading technique unlikely to appear in benign telemetry.

Malicious Storm-2603 Ransom Note File Creation

This rule detects the creation of the ransom note file 'How to decrypt my data.txt' dropped by Storm-2603 ransomware payloads. Appearance of this file across user directories signals that file encryption has already executed on the host and the operator is presenting extortion instructions to the victim.

Suspicious WezRat Keylog File in Temp Directory

This rule detects creation of the fixed keylog output file 10105060.txt in the user Temp directory used by the WezRat backdoor. The malware records captured keystrokes to this static filename before exfiltration. Detecting the artifact confirms keylogging activity on the host.

Suspicious BugSleep Marker File in Public Directory

This rule detects creation of a file named a.txt in the C-Users-Public directory, an existence marker used by the BugSleep backdoor during its injection routine. The malware writes and checks this public path artifact to coordinate its shellcode injection into browser and remote access processes. Detecting the marker can surface the backdoor on the host.

Possible Ransomware Note or Encrypted File Extension Creation

This rule detects creation of ransom note files or files renamed with encrypted extensions used by the ransomware families compared in this research. The specific note names and extensions appear only after data has been encrypted on the victim host. Detecting them confirms an active encryption event so responders can isolate the machine.

Suspicious Executable Written to User Documents Subfolder (via file_event)

This rule detects an executable being dropped into a subfolder of a user Documents directory, matching BundleBot behaviour of hiding its payload under a randomly named Documents folder. Executables rarely originate here through normal use, so writes of this kind warrant inspection for stealer staging.

Xeno Stealer Persistence via Display Calibration Run Key

This rule detects creation of a Run key value named Display Calibration used by the Xeno stealer for autostart persistence. The value points to a JAR staged under the GameDVR directory and masquerades as a benign display setting.

Hidden PowerShell Archive Extraction via ExtractToDirectory

This rule detects a hidden PowerShell process using the System IO Compression ZipFile ExtractToDirectory method together with an execution policy bypass. The Xeno loader uses this routine to unpack its bundled Java runtime and stealer payload.

Possible PurpleFox MSHTA to Msiexec Remote MSI Chain

This rule detects msiexec.exe spawned by mshta.exe to install a remotely hosted MSI package often disguised as an image file. This execution chain matches the PurpleFox loader delivery observed in MSHTA abuse campaigns.

Suspicious MSHTA VBScript WScript Shell Execution

This rule detects mshta.exe executing an inline vbscript command that instantiates WScript.Shell to run a child process. This fileless technique is used by PurpleFox and XWorm loaders to spawn cmd or PowerShell without dropping a script to disk.

Suspicious Remote HTA Payload Execution via MSHTA

This rule detects mshta.exe launched with a remote http or https URL argument to retrieve and execute a remote HTML Application payload. Loaders such as CountLoader and Emmenhtal abuse this behavior to stage LummaStealer and other malware in memory.

Suspicious Node.js Script Execution from AppData Roaming

This rule detects the Node.js runtime executing from a hidden node_x86 directory under user AppData Roaming. This matches the persistence footprint of a malicious Windsurf IDE extension that stages its loader outside standard install paths and communicates over the Solana blockchain.

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

This rule detects a ClickFix style command that decodes a hex encoded string in PowerShell and pipes the result into a second PowerShell instance for execution. This pattern delivers CastleLoader and related payloads directly in memory.

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

This rule detects extrac32.exe extracting a cabinet archive that uses a deceptive vstm extension. This delivery step was observed in CastleLoader and LummaStealer fake installer campaigns to unpack staged components.